1200KM / detection
T1098.006 Additional Container Cluster Roles — Detection Rules
Detection workspace for T1098.006 Additional Container Cluster Roles: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0572 Suspicious RoleBinding or ClusterRoleBinding Assignment in Kubernetes
AN1579 Analytic 1579
Detects assignment of high-privilege roles to user or service accounts via Kubernetes RoleBinding or ClusterRoleBinding objects, especially outside of CI/CD automation or from unknown IPs.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1098.006 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.