Kubernetes Role With Node Proxy Permissions Created

Description

This detection monitors for Roles or ClusterRoles being created with permissions to access node proxy endpoints (nodes/proxy or nodes/*). These permissions allow users to access the kubelet API through the Kubernetes API server proxy, enabling privilege escalation by executing commands on nodes, accessing container logs and filesystems, and potentially escaping to the underlying host. This technique is documented by Stratus Red Team as a privilege escalation vector.

Query · python

from panther_kubernetes_helpers import is_failed_request, is_system_principal, k8s_alert_context


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check role/clusterrole creation events
    if verb != "create" or resource not in {"roles", "clusterroles"}:
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals to reduce false positives
    if is_system_principal(username):
        return False

    # Check request object for node/proxy permissions
    request_object = event.udm("requestObject") or {}
    rules = request_object.get("rules") or []

    for rule_config in rules:
        resources = rule_config.get("resources") or []
        verbs = rule_config.get("verbs") or []

        # Check for nodes/proxy or nodes/* permissions
        # These allow accessing the kubelet API through the API server proxy
        if "nodes/proxy" in resources or ("nodes/*" in resources and verbs):
            return True

        # Also check for wildcard on nodes with specific verbs that enable proxy access
        if "nodes" in resources and "*" in resources:
            return True

    return False


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    resource = event.udm("resource") or "<UNKNOWN_RESOURCE>"
    name = event.udm("name") or "<UNKNOWN_ROLE>"

    role_type = "ClusterRole" if resource == "clusterroles" else "Role"

    return f"[{username}] created {role_type} [{name}] with node proxy permissions"


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    name = event.udm("name") or "<UNKNOWN_ROLE>"
    return f"k8s_node_proxy_{username}_{name}"


def alert_context(event):
    request_object = event.udm("requestObject") or {}
    rules = request_object.get("rules") or []

    # Extract rules with node/proxy permissions
    dangerous_rules = []
    for rule_config in rules:
        resources = rule_config.get("resources") or []
        if "nodes/proxy" in resources or "nodes/*" in resources or "nodes" in resources:
            dangerous_rules.append(rule_config)

    return k8s_alert_context(
        event,
        extra_fields={
            "role_name": event.udm("name"),
            "role_type": event.udm("resource"),
            "dangerous_rules": dangerous_rules,
        },
    )

Analyst notes

Query all RBAC operations by the username in the 2 hours before and after the alert to identify the scope of role creation activity
Find all RoleBindings or ClusterRoleBindings that reference this role name in the 24 hours after creation to determine who was granted these permissions
Search for API operations to nodes/proxy endpoints from the p_source_label cluster in the past 7 days to identify if these permissions have been exploited

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-02-17
Modified: 2026-05-05
Authored by: panther-labs
Source ID
Upstream: rules/kubernetes_rules/k8s_role_node_proxy_permissions.yml
Type: rule
Version: 3
References: https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/
Data sources: Amazon.EKS.AuditAzure.MonitorActivityGCP.AuditLog

ATT&CK

TA0004TA0005 T1078.004 T1562.001