Query: alert when Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Matching passage: Sigma rule: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted id: 25cb259b-bbdc-4b87-98b7-90d7c72f8743 status: test description: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE condition: selection falsepositives: - RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitim. Logsource: windows / process_creation. Rule: title: Windows Defender Disabled Via SystemSettingsAdminFlows.EXE id: da92713f-ca2d-4fab-8320-098013d3f43a status: experimental description: 'Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks. However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns. ' references: - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ - https://www.huntress.com/blog/lolbin-to-inc-ransomware tags: - attack.defense-impairment - attack.t1685 author: Chirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 logsource: category: process_creation product: windows detection: selection_ssaf_img: - Image|endswith: \SystemSettingsAdminFlows.exe - OriginalFileName: SystemSettingsAdminFlows.EXE selection_ssaf_cli: CommandLine|contains: defender selection_cli_enable_opt: CommandLine|contains: - 'RTP ' - 'RealTimeProtection ' - 'DisableEnhancedNotifications ' selection_cli_enable_value: CommandLine|contains: '1' selection_cli_disable_opt: CommandLine|contains: - 'SubmitSamplesConsent ' - 'SpyNetReporting ' - 'DisableCDPUserAuthPolicy ' selection_cli_disable_value: CommandLine|contains: '0' condition: all of selection_ssaf_* and (all of selection_cli_enable_* or all of selection_cli_disable_*) falsepositives: - Legitimate turn off of Windows Defender by the technical users or administrators for troubleshooting or other purposes. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_systemsettingsadminflows_defender_disable/info.yml