T1098.006 — Additional Container Cluster Roles

Tactics: Persistence, Privilege Escalation · Platforms: Containers

An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (1)

T1098.006 Account Manipulation: Additional Container Cluster Roles

title: "T1098.006 Account Manipulation: Additional Container Cluster Roles"
id: 1cd04f41-fb10-4dcb-8c3a-14717a0f3f2a
description: 'Suspicious RoleBinding or ClusterRoleBinding Assignment in Kubernetes. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: UserAgent, RoleName, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1098/006
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.006

logsource:
  product: kubernetes
  service: audit

detection:
  selection:
    verb:
      - 'create'
      - 'update'
    objectRef.resource:
      - 'clusterrolebindings'
      - 'rolebindings'
  selection_privileged:
    requestObject.roleRef.name|contains: 'cluster-admin'

  condition: selection and selection_privileged

falsepositives:
  - Cluster administrators legitimately provisioning new cluster-admin bindings for approved operators.

level: critical

Related sub-techniques

Explore