This rule detects the creation of a RoleBinding or ClusterRoleBinding that grants the cluster-admin ClusterRole within AWS EKS, indicating a high-risk privilege escalation or misconfiguration. It processes EKS control-plane audit events ingested via the AWS integration into the aws.eks_audit data stream, focusing on create operations that bind cluster-admin to a subject (RoleBinding or ClusterRoleBinding). The rule’s Kibana Query Language (Kuery) filters for resource types clusterrolebindings/rolebindings, verb create, and roleRef.name cluster-admin, while ensuring the request is authorized (authorization_k8s_io/decision: allow) and that the audit stage is ResponseComplete. This yields detection for potential abuse such as binding a service account or external identity to cluster-admin, enabling broad access to all Kubernetes resources. The rule is tied to MITRE ATT&CK techniques Account Manipulation (T1098, with subtechnique Additional Container Cluster Roles T1098.006) and both Persistence and Privilege Escalation (TA0003 and TA0004). It includes integration-specific setup guidance (enable EKS audit logs, send to CloudWatch, and verify data_stream.dataset and cloud.provider before activation). The rule’s risk score is 47 with a medium severity, reflecting the dangerous but potentially legitimate administrative activity in controlled change windows. The accompanying investigation guide covers sourcing the creator identity, validating the binding’s subject, correlating with authentication and credential changes, and examining follow-on activity (e.g., secret access, privileged resource creation). Remediation emphasizes immediate revocation of the binding, credential rotation, quarantine of affected workloads, auditing of subsequent changes, and restoration of least-privilege RBAC from verified baselines. False positives may arise from break-glass or emergency recovery workflows that temporarily grant cluster-admin, or approved maintenance tasks within change windows. The rule is designed for cloud/Kubernetes environments (AWS EKS) and leverages AWS audit logs to detect overly permissive RBAC changes across the cluster.