{"id":"T1098.006","name":"Additional Container Cluster Roles","url":"https://attack.mitre.org/techniques/T1098/006","tactics":["persistence","privilege-escalation"],"platforms":["Containers"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0572","stix_id":"x-mitre-detection-strategy--7c27cb31-4806-479f-a07b-900450236a57","name":"Suspicious RoleBinding or ClusterRoleBinding Assignment in Kubernetes","url":"https://attack.mitre.org/detectionstrategies/DET0572","analytics":[{"id":"AN1579","stix_id":"x-mitre-analytic--b721ae18-79fc-4b82-8991-93980b14ded5","name":"Analytic 1579","description":"Detects assignment of high-privilege roles to user or service accounts via Kubernetes RoleBinding or ClusterRoleBinding objects, especially outside of CI/CD automation or from unknown IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0572#AN1579","platforms":["Containers"],"log_source_references":[{"name":"kubernetes:audit","channel":"create or update events for RoleBinding or ClusterRoleBinding objects","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"kubernetes-audit"}],"mutable_elements":[{"field":"UserAgent","description":"Filter expected sources of automated role assignment (e.g., CI/CD tooling)"},{"field":"RoleName","description":"Scope to privileged roles like cluster-admin, edit, admin"},{"field":"TimeWindow","description":"Detect after-hours or irregular-time assignments"},{"field":"UserContext","description":"Define known service accounts and privileged operators to reduce noise"}],"live":true,"detection_strategies":["DET0572"],"techniques":["T1098.006"]}],"live":true,"version":"1.0","techniques":["T1098.006"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}