T1098.006sub-technique of T1098 Account Manipulation
Additional Container Cluster Roles
Containersnothing on this site yetT1098.006 on attack.mitre.org
An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Suspicious RoleBinding or ClusterRoleBinding Assignment in Kubernetes
- Detects assignment of high-privilege roles to user or service accounts via Kubernetes RoleBinding or ClusterRoleBinding objects, especially outside of CI/CD automation or from unknown IPs.
what reduces it
- M1018 User Account Management. Ensure that low-privileged accounts do not have permissions to add permissions to accounts or to update container cluster roles.
- M1032 Multi-factor Authentication. Require multi-factor authentication for user accounts integrated into container clusters through cloud deployments or via authentication protocols such as LDAP or SAML.