Sigma rule: RBAC Permission Enumeration Attempt

Rule

Title

RBAC Permission Enumeration Attempt

Status

test

Level

low

Author

Leo Tsaousis (@laripping)

Date

2024-03-26

File

rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects identities attempting to enumerate their Kubernetes RBAC permissions.
In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.
In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command.
This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.

Log source

product

kubernetes

service

audit

category

application

Detection

selection:
    verb: 'create'
    apiGroup: 'authorization.k8s.io'
    objectRef.resource: 'selfsubjectrulesreviews'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.t1069.003
• attack.t1087.004
• attack.discovery

MITRE ATT&CK ids this rule names

• T1069.003
• T1087.004

References

• https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml