GKE Pod Exec Cloud Instance Metadata Access

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions whose command references Google Cloud instance metadata endpoints, including
 11metadata.google.internal, computeMetadata/v1, or the link-local metadata IP 169.254.169.254. Workloads that reach the
 12GKE metadata service from an exec session are often attempting to harvest short-lived credentials or instance attributes
 13from the node or workload identity boundary. That behavior is high risk because it can expose cloud credentials to code
 14running inside a container. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command
 15is passed to exec.
 16"""
 17false_positives = [
 18    """
 19    Break-glass debugging from platform engineers may include curl to the metadata IP or hostname.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE Pod Exec Cloud Instance Metadata Access"
 27note = """## Triage and analysis
 28
 29### Investigating GKE Pod Exec Cloud Instance Metadata Access
 30
 31This alert fires when a successful pods/exec API call includes a command targeting GKE/GCP instance metadata.
 32Review `gcp.audit.labels.command.gke.io/command` for the full command string.
 33
 34### Possible investigation steps
 35
 36- Confirm the actor (`client.user.email`), source IP, and user agent that performed exec.
 37- Map `gcp.audit.resource_name` to the target pod/namespace and determine whether the workload should ever call metadata.
 38- Correlate with GCP audit logs for token issuance or IAM activity around the same time from the node or workload identity.
 39- Hunt adjacent activity from the same identity: secret reads, additional execs, or RBAC changes.
 40
 41### False positive analysis
 42
 43- Approved platform tooling or bootstrap scripts may query metadata during startup; baseline those images and identities.
 44- Break-glass egress/metadata connectivity tests can match; document and allowlist those principals.
 45
 46### Response and remediation
 47
 48- If unauthorized, terminate the session, isolate the workload, revoke or rotate instance and workload credentials that
 49  could have been read, and tighten pods/exec RBAC plus network policies that deny link-local metadata from pods.
 50"""
 51setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 52references = [
 53    "https://cloud.google.com/kubernetes-engine/docs/concepts/protecting-cluster-metadata",
 54]
 55risk_score = 73
 56rule_id = "c8bf56cc-c648-4f88-bb4f-9e504d0779d1"
 57severity = "high"
 58tags = [
 59    "Domain: Cloud",
 60    "Domain: Kubernetes",
 61    "Data Source: GCP",
 62    "Data Source: Google Cloud Platform",
 63    "Data Source: GCP Audit Logs",
 64    "Use Case: Threat Detection",
 65    "Tactic: Credential Access",
 66    "Tactic: Execution",
 67    "Resources: Investigation Guide",
 68    "Noise: Unknown",
 69    "Performance: Fast",
 70    "Profile: Recommended",
 71    "Threat: IMDS Credential Theft",
 72    "Rule Type: Custom Query (KQL)",
 73    "Platform: GCP",
 74    "Domain: Containers",
 75    "Platform: Kubernetes",
 76]
 77timestamp_override = "event.ingested"
 78type = "query"
 79
 80query = '''
 81data_stream.dataset:gcp.audit and service.name:"k8s.io" and
 82event.outcome:success and event.type:start and
 83event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 84gcp.audit.labels.command.gke.io/command:(
 85  *169.254.169.254* or *metadata.google.internal* or *computeMetadata/v1*
 86)
 87'''
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91
 92[[rule.threat.technique]]
 93id = "T1552"
 94name = "Unsecured Credentials"
 95reference = "https://attack.mitre.org/techniques/T1552/"
 96
 97[[rule.threat.technique.subtechnique]]
 98id = "T1552.005"
 99name = "Cloud Instance Metadata API"
100reference = "https://attack.mitre.org/techniques/T1552/005/"
101
102[rule.threat.tactic]
103id = "TA0006"
104name = "Credential Access"
105reference = "https://attack.mitre.org/tactics/TA0006/"
106
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109
110[[rule.threat.technique]]
111id = "T1609"
112name = "Container Administration Command"
113reference = "https://attack.mitre.org/techniques/T1609/"
114
115[rule.threat.tactic]
116id = "TA0002"
117name = "Execution"
118reference = "https://attack.mitre.org/tactics/TA0002/"
119
120[rule.investigation_fields]
121field_names = [
122    "@timestamp",
123    "client.user.email",
124    "source.ip",
125    "user_agent.original",
126    "event.action",
127    "event.outcome",
128    "event.type",
129    "gcp.audit.labels.command.gke.io/command",
130    "gcp.audit.resource_name",
131    "data_stream.namespace",
132]