From b753a05c72e3daebefaefde00033e10dd9669a80 Mon Sep 17 00:00:00 2001 From: Jonhnathan Date: Thu, 27 Jan 2022 09:31:51 -0300 Subject: [PATCH] [Rule Tuning] GCP Kubernetes Rolebindings Created or Patched (#1718) * Update privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml * Update rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml Co-authored-by: Justin Ibarra Co-authored-by: Justin Ibarra (cherry picked from commit 38ae64f72924735e283ad2c42fb8cf11e2a88801) --- ...ation_gcp_kubernetes_rolebindings_created_or_patched.toml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml b/rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml index a9c33688b..b98e6023a 100644 --- a/rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml +++ b/rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2021/06/06" maturity = "production" -updated_date = "2021/12/13" +updated_date = "2022/01/24" integration = "gcp" [rule] @@ -33,7 +33,8 @@ type = "query" query = ''' event.dataset:(googlecloud.audit or gcp.audit) and event.action:(io.k8s.authorization.rbac.v*.clusterrolebindings.create or io.k8s.authorization.rbac.v*.rolebindings.create or io.k8s.authorization.rbac.v*.clusterrolebindings.patch or -io.k8s.authorization.rbac.v*.rolebindings.patch) and event.outcome:success +io.k8s.authorization.rbac.v*.rolebindings.patch) and event.outcome:success and +not gcp.audit.authentication_info.principal_email:"system:addon-manager" '''