Elastic medium stable kql

GKE Creation of a RoleBinding Referencing a ServiceAccount

Detects creation of a GKE RoleBinding or ClusterRoleBinding that grants permissions to a ServiceAccount, which may indicate privilege delegation or RBAC misconfiguration leading to elevated access.

View Source

Detection Logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.rolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create"
) and gcp.audit.request.subjects.kind:"ServiceAccount" and not client.user.email:(
  "system:apiserver" or
  "gcp:kube-bootstrap"
)

False Positives

⚠ GitOps, namespace onboarding, and workload deployment commonly create RoleBindings for service accounts. Default bootstrap bindings from `system:apiserver` and GKE node bootstrap from `gcp:kube-bootstrap` are excluded.

Field Validations

Loading…

Comments (0)

Loading comments...