Kubernetes Role With Wildcard Permissions Created

Description

This detection monitors for Roles or ClusterRoles being created with wildcard (*) permissions in resources or verbs. Wildcard permissions grant overly broad access, such as all operations on all resources, which violates the principle of least privilege. Attackers who gain RBAC modification permissions often create wildcard roles to maximize their access across the cluster without knowing specific resource names or API operations.

Query · python

from panther_kubernetes_helpers import is_failed_request, is_system_principal, k8s_alert_context


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check Role/ClusterRole creation events
    if verb != "create" or resource not in {"roles", "clusterroles"}:
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals to reduce false positives from legitimate operators
    if is_system_principal(username):
        return False

    # Check if role grants wildcard permissions
    request_object = event.udm("requestObject") or {}
    rules = request_object.get("rules") or []

    for rule_entry in rules:
        resources = rule_entry.get("resources") or []
        verbs = rule_entry.get("verbs") or []

        # Check for wildcard in resources or verbs
        if "*" in resources or "*" in verbs:
            return True

    return False


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    resource = event.udm("resource") or "<UNKNOWN_RESOURCE>"
    name = event.udm("name") or "<UNKNOWN_ROLE>"
    namespace = event.udm("namespace") or "<CLUSTER_SCOPED>"

    role_type = "ClusterRole" if resource == "clusterroles" else "Role"

    if namespace != "<CLUSTER_SCOPED>":
        return f"[{username}] created {role_type} [{namespace}/{name}] with wildcard permissions"

    return f"[{username}] created {role_type} [{name}] with wildcard permissions "


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    resource = event.udm("resource") or "<UNKNOWN_RESOURCE>"
    name = event.udm("name") or "<UNKNOWN_ROLE>"
    return f"k8s_role_wildcard_{username}_{resource}_{name}"


def severity(event):
    """ClusterRoles with wildcards are more dangerous than namespaced Roles."""
    resource = event.udm("resource") or ""

    # Critical for ClusterRole (cluster-wide wildcard permissions)
    if resource == "clusterroles":
        return "CRITICAL"

    # High for namespaced Role (namespace-scoped wildcard permissions)
    return "HIGH"


def alert_context(event):
    request_object = event.udm("requestObject") or {}
    rules = request_object.get("rules") or []

    # Extract only the rules that contain wildcards
    wildcard_rules = []
    for rule_entry in rules:
        resources = rule_entry.get("resources") or []
        verbs = rule_entry.get("verbs") or []
        if "*" in resources or "*" in verbs:
            wildcard_rules.append(rule_entry)

    return k8s_alert_context(
        event,
        extra_fields={
            "role_name": event.udm("name"),
            "role_type": event.udm("resource"),
            "wildcard_rules": wildcard_rules,
        },
    )

Analyst notes

Review the role rules to identify the scope of wildcard permissions and determine if this role creation is expected
Identify all API operations by the creating user in the 2 hours before and after the alert and search for RoleBindings or ClusterRoleBindings that reference this role
If unauthorized, immediately delete the role and any bindings, then audit all API activity in the cluster in the past 24 hours to assess impact

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-02-17
Modified: 2026-02-17
Authored by: panther-labs
Source ID
Upstream: rules/kubernetes_rules/k8s_role_wildcard.yml
Type: rule
Version: 2
Data sources: Amazon.EKS.AuditAzure.MonitorActivityGCP.AuditLog

ATT&CK

TA0004TA0005 T1078.004