type: attack-pattern
spec_version: 2.1
id: attack-pattern--35d30338-5bfa-41b0-a170-ec06dfd75f64
created: 2023-07-14T14:01:50.806Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1098/006
external_id: T1098.006
source_name: AWS EKS IAM Roles for Service Accounts
description: Amazon Web Services. (n.d.). IAM roles for service accounts. Retrieved July 14, 2023.
url: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
source_name: Google Cloud Kubernetes IAM
description: Google Cloud. (n.d.). Create IAM policies. Retrieved July 14, 2023.
url: https://cloud.google.com/kubernetes-engine/docs/how-to/iam
source_name: Kuberentes ABAC
description: Kuberenets. (n.d.). Using ABAC Authorization. Retrieved July 14, 2023.
url: https://kubernetes.io/docs/reference/access-authn-authz/abac/
source_name: Kubernetes RBAC
description: Kubernetes. (n.d.). Role Based Access Control Good Practices. Retrieved March 8, 2023.
url: https://kubernetes.io/docs/concepts/security/rbac-good-practices/
source_name: Aquasec Kubernetes Attack 2023
description: Michael Katchinskiy, Assaf Morag. (2023, April 21). First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters. Retrieved July 14, 2023.
url: https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters
source_name: Microsoft Azure Kubernetes Service Service Accounts
description: Microsoft Azure. (2023, April 28). Access and identity options for Azure Kubernetes Service (AKS). Retrieved July 14, 2023.
url: https://learn.microsoft.com/en-us/azure/aks/concepts-identity
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T21:46:31.661Z
name: Additional Container Cluster Roles
description: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)
 
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. 

Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
x_mitre_version: 1.0