GKE Pod Exec Cloud Instance Metadata Access

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions whose command references Google Cloud instance metadata endpoints, including
 11metadata.google.internal, computeMetadata/v1, or the link-local metadata IP 169.254.169.254. Workloads that reach the
 12GKE metadata service from an exec session are often attempting to harvest short-lived credentials or instance attributes
 13from the node or workload identity boundary. That behavior is high risk because it can expose cloud credentials to code
 14running inside a container. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command
 15is passed to exec.
 16"""
 17false_positives = [
 18    """
 19    Break-glass debugging from platform engineers may include curl to the metadata IP or hostname.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE Pod Exec Cloud Instance Metadata Access"
 27note = """## Triage and analysis
 28
 29### Investigating GKE Pod Exec Cloud Instance Metadata Access
 30
 31This alert fires when a successful pods/exec API call includes a command targeting GKE/GCP instance metadata.
 32Review `gcp.audit.labels.command.gke.io/command` for the full command string.
 33
 34### Possible investigation steps
 35
 36- Confirm the actor (`client.user.email`), source IP, and user agent that performed exec.
 37- Map `gcp.audit.resource_name` to the target pod/namespace and determine whether the workload should ever call metadata.
 38- Correlate with GCP audit logs for token issuance or IAM activity around the same time from the node or workload identity.
 39- Hunt adjacent activity from the same identity: secret reads, additional execs, or RBAC changes.
 40
 41### False positive analysis
 42
 43- Approved platform tooling or bootstrap scripts may query metadata during startup; baseline those images and identities.
 44- Break-glass egress/metadata connectivity tests can match; document and allowlist those principals.
 45
 46### Response and remediation
 47
 48- If unauthorized, terminate the session, isolate the workload, revoke or rotate instance and workload credentials that
 49  could have been read, and tighten pods/exec RBAC plus network policies that deny link-local metadata from pods.
 50"""
 51setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 52references = [
 53    "https://cloud.google.com/kubernetes-engine/docs/concepts/protecting-cluster-metadata",
 54]
 55risk_score = 73
 56rule_id = "c8bf56cc-c648-4f88-bb4f-9e504d0779d1"
 57severity = "high"
 58tags = [
 59    "Domain: Cloud",
 60    "Domain: Kubernetes",
 61    "Data Source: GCP",
 62    "Data Source: GCP Audit Logs",
 63    "Data Source: Google Cloud Platform",
 64    "Use Case: Threat Detection",
 65    "Tactic: Credential Access",
 66    "Tactic: Execution",
 67    "Resources: Investigation Guide",
 68]
 69timestamp_override = "event.ingested"
 70type = "query"
 71
 72query = '''
 73data_stream.dataset:gcp.audit and service.name:"k8s.io" and
 74event.outcome:success and event.type:start and
 75event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 76gcp.audit.labels.command.gke.io/command:(
 77  *169.254.169.254* or *metadata.google.internal* or *computeMetadata/v1*
 78)
 79'''
 80
 81[[rule.threat]]
 82framework = "MITRE ATT&CK"
 83
 84[[rule.threat.technique]]
 85id = "T1552"
 86name = "Unsecured Credentials"
 87reference = "https://attack.mitre.org/techniques/T1552/"
 88
 89[[rule.threat.technique.subtechnique]]
 90id = "T1552.005"
 91name = "Cloud Instance Metadata API"
 92reference = "https://attack.mitre.org/techniques/T1552/005/"
 93
 94[rule.threat.tactic]
 95id = "TA0006"
 96name = "Credential Access"
 97reference = "https://attack.mitre.org/tactics/TA0006/"
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101
102[[rule.threat.technique]]
103id = "T1609"
104name = "Container Administration Command"
105reference = "https://attack.mitre.org/techniques/T1609/"
106
107[rule.threat.tactic]
108id = "TA0002"
109name = "Execution"
110reference = "https://attack.mitre.org/tactics/TA0002/"
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "client.user.email",
116    "source.ip",
117    "user_agent.original",
118    "event.action",
119    "event.outcome",
120    "event.type",
121    "gcp.audit.labels.command.gke.io/command",
122    "gcp.audit.resource_name",
123    "data_stream.namespace",
124]