GKE Pod Exec Sensitive File or Credential Path Access

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions where the executed command references high-value host or in-cluster paths:
 11mounted service account or platform tokens, kubelet and control-plane configuration areas, host identity stores, root
 12or home credential directories, common private-key and keystore extensions, process environment dumps, and configuration
 13filenames suggestive of embedded secrets. Attackers with pods/exec often use these one-liners to steal credentials
 14before lateral movement or privilege escalation. A narrow exclusion ignores benign resolv.conf reads. GKE records the
 15command in gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.
 16"""
 17false_positives = [
 18    """
 19    Break-glass debugging or vendor diagnostics may cat credential-adjacent paths. Baseline approved operators and
 20    automation identities, then expand client.user.email exclusions as needed.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-gcp.audit-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "GKE Pod Exec Sensitive File or Credential Path Access"
 28note = """## Triage and analysis
 29
 30### Investigating GKE Pod Exec Sensitive File or Credential Path Access
 31
 32This alert fires when a successful pods/exec API call includes a command matching sensitive path or filename
 33patterns. Review `gcp.audit.labels.command.gke.io/command` for the reconstructed command string.
 34
 35### Possible investigation steps
 36
 37- Identify the actor (`client.user.email`), source IP, and user agent for the exec caller.
 38- Map `gcp.audit.resource_name` (namespace/pod) to a workload owner, image, and change history.
 39- Correlate adjacent activity from the same identity: secret reads, TokenRequest, RBAC writes, or additional execs.
 40- If host-level paths appear, determine whether the workload is privileged, uses hostPath, or runs on break-glass nodes.
 41
 42### False positive analysis
 43
 44- Diagnostic images and vendor agents sometimes read kubeconfig-like or credential paths; baseline stable automation.
 45- Training containers that deliberately demonstrate passwd reads can trigger; scope exceptions to those namespaces.
 46
 47### Response and remediation
 48
 49- If malicious, end the exec session, isolate the pod or node, rotate credentials that could have been read, and
 50  tighten pods/exec RBAC and admission controls.
 51"""
 52setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 53references = [
 54    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.credential-access.steal-serviceaccount-token/",
 55]
 56risk_score = 73
 57rule_id = "0fc705f5-544e-4786-8acc-c73cd74e77cf"
 58severity = "high"
 59tags = [
 60    "Domain: Cloud",
 61    "Domain: Kubernetes",
 62    "Data Source: GCP",
 63    "Data Source: Google Cloud Platform",
 64    "Data Source: GCP Audit Logs",
 65    "Use Case: Threat Detection",
 66    "Tactic: Credential Access",
 67    "Tactic: Execution",
 68    "Resources: Investigation Guide",
 69    "Noise: Unknown",
 70    "Performance: Fast",
 71    "Rule Type: Custom Query (KQL)",
 72    "Platform: GCP",
 73    "Domain: Containers",
 74    "Platform: Kubernetes",
 75]
 76timestamp_override = "event.ingested"
 77type = "query"
 78
 79query = '''
 80data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 81event.type:start and
 82event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 83gcp.audit.labels.command.gke.io/command:(
 84  (
 85    *.jks* or *.key* or *.keystore* or *.p12* or *.pem* or
 86    */etc/kubernetes/* or */etc/passwd* or */etc/shadow* or */etc/sudoers* or
 87    */home/*/.aws* or */home/*/.azure* or */home/*/.config/gcloud* or */home/*/.kube* or */home/*/.ssh* or
 88    */proc/*/environ* or
 89    */root/.aws* or */root/.azure* or */root/.config/gcloud* or */root/.kube* or */root/.ssh* or
 90    */var/lib/kubelet/* or */var/run/secrets/* or
 91    */etc/*.conf* and (*credential* or *key* or *password* or *secret* or *token*)
 92  ) and not */etc/resolv.conf*
 93)
 94'''
 95
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98
 99[[rule.threat.technique]]
100id = "T1552"
101name = "Unsecured Credentials"
102reference = "https://attack.mitre.org/techniques/T1552/"
103
104[[rule.threat.technique.subtechnique]]
105id = "T1552.001"
106name = "Credentials In Files"
107reference = "https://attack.mitre.org/techniques/T1552/001/"
108
109[[rule.threat.technique.subtechnique]]
110id = "T1552.007"
111name = "Container API"
112reference = "https://attack.mitre.org/techniques/T1552/007/"
113
114[rule.threat.tactic]
115id = "TA0006"
116name = "Credential Access"
117reference = "https://attack.mitre.org/tactics/TA0006/"
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121
122[[rule.threat.technique]]
123id = "T1609"
124name = "Container Administration Command"
125reference = "https://attack.mitre.org/techniques/T1609/"
126
127[rule.threat.tactic]
128id = "TA0002"
129name = "Execution"
130reference = "https://attack.mitre.org/tactics/TA0002/"
131
132[rule.investigation_fields]
133field_names = [
134    "@timestamp",
135    "client.user.email",
136    "source.ip",
137    "user_agent.original",
138    "event.action",
139    "event.outcome",
140    "event.type",
141    "gcp.audit.labels.command.gke.io/command",
142    "gcp.audit.resource_name",
143    "data_stream.namespace",
144]