---
title: GKE Cluster-Admin Role Binding Created or Modified
description: Detects creation or modification of a GKE ClusterRoleBinding that grants the cluster-admin ClusterRole, providing unrestricted cluster access and enabling...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_cluster_admin_role_binding
products:
  - Elastic Security
---

# GKE Cluster-Admin Role Binding Created or Modified
Detects creation or modification of a GKE ClusterRoleBinding that grants the cluster-admin ClusterRole, providing
unrestricted cluster access and enabling rapid privilege escalation or persistence.
**Rule type**: query
**Rule indices**:
- logs-gcp.audit-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: ``
**Maximum alerts per execution**: 100
**References**:
- [[https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control)](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control)
- [[https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control](https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control)](https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Persistence
- Tactic: Privilege Escalation
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Fast
- Rule Type: Custom Query (KQL)
- Platform: GCP
- Domain: Containers
- Platform: Kubernetes

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

## Investigation guide


## Triage and analysis


### Investigating GKE Cluster-Admin Role Binding Created or Modified

Identify who created or changed the binding and which subject received cluster-admin.

### Investigation steps

- Review `client.user.email`, `source.ip`, and `gcp.audit.request` for the bound subject.
- Hunt for secret reads, privileged pod creation, or webhook changes from the same actor or new subject.


### False positives

- Bootstrap and recovery may recreate cluster-admin bindings via `system:apiserver` during control plane reconciliation (excluded).


## Rule Query

```kuery
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.update"
) and gcp.audit.request.kind:"ClusterRoleBinding" and
gcp.audit.resource_name:"rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin" and
not client.user.email:"system:apiserver"
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Account Manipulation
  - Id: T1098
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)](https://attack.mitre.org/techniques/T1098/)
- Sub Technique:
  - Name: Additional Container Cluster Roles
  - Id: T1098.006
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/006/](https://attack.mitre.org/techniques/T1098/006/)](https://attack.mitre.org/techniques/T1098/006/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Account Manipulation
  - Id: T1098
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)](https://attack.mitre.org/techniques/T1098/)
- Sub Technique:
  - Name: Additional Container Cluster Roles
  - Id: T1098.006
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/006/](https://attack.mitre.org/techniques/T1098/006/)](https://attack.mitre.org/techniques/T1098/006/)