{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--35d30338-5bfa-41b0-a170-ec06dfd75f64",
  "created": "2023-07-14T14:01:50.806Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1098/006",
      "external_id": "T1098.006"
    },
    {
      "source_name": "AWS EKS IAM Roles for Service Accounts",
      "description": "Amazon Web Services. (n.d.). IAM roles for service accounts. Retrieved July 14, 2023.",
      "url": "https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html"
    },
    {
      "source_name": "Google Cloud Kubernetes IAM",
      "description": "Google Cloud. (n.d.). Create IAM policies. Retrieved July 14, 2023.",
      "url": "https://cloud.google.com/kubernetes-engine/docs/how-to/iam"
    },
    {
      "source_name": "Kuberentes ABAC",
      "description": "Kuberenets. (n.d.). Using ABAC Authorization. Retrieved July 14, 2023.",
      "url": "https://kubernetes.io/docs/reference/access-authn-authz/abac/"
    },
    {
      "source_name": "Kubernetes RBAC",
      "description": "Kubernetes. (n.d.). Role Based Access Control Good Practices. Retrieved March 8, 2023.",
      "url": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/"
    },
    {
      "source_name": "Aquasec Kubernetes Attack 2023",
      "description": "Michael Katchinskiy, Assaf Morag. (2023, April 21). First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters. Retrieved July 14, 2023.",
      "url": "https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters"
    },
    {
      "source_name": "Microsoft Azure Kubernetes Service Service Accounts",
      "description": "Microsoft Azure. (2023, April 28). Access and identity options for Azure Kubernetes Service (AKS). Retrieved July 14, 2023.",
      "url": "https://learn.microsoft.com/en-us/azure/aks/concepts-identity"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-04-15T21:46:31.661Z",
  "name": "Additional Container Cluster Roles",
  "description": "An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)\n \nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised.  \n\nNote that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based  role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "persistence"
    },
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "privilege-escalation"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Containers"
  ],
  "x_mitre_version": "1.0"
}