Techniques › T1098.006 › AN1579
AN1579 Analytic 1579
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects assignment of high-privilege roles to user or service accounts via Kubernetes RoleBinding or ClusterRoleBinding objects, especially outside of CI/CD automation or from unknown IPs.</p>
- Detects
- T1098.006 Additional Container Cluster Roles
- Part of
- DET0572 Suspicious RoleBinding or ClusterRoleBinding Assignment in Kubernetes
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| kubernetes:audit | create or update events for RoleBinding or ClusterRoleBinding objects | DC0010 User Account Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserAgent | Filter expected sources of automated role assignment (e.g., CI/CD tooling) |
RoleName | Scope to privileged roles like cluster-admin, edit, admin |
TimeWindow | Detect after-hours or irregular-time assignments |
UserContext | Define known service accounts and privileged operators to reduce noise |