GKE Pod Exec Sensitive File or Credential Path Access

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions where the executed command references high-value host or in-cluster paths:
 11mounted service account or platform tokens, kubelet and control-plane configuration areas, host identity stores, root
 12or home credential directories, common private-key and keystore extensions, process environment dumps, and configuration
 13filenames suggestive of embedded secrets. Attackers with pods/exec often use these one-liners to steal credentials
 14before lateral movement or privilege escalation. A narrow exclusion ignores benign resolv.conf reads. GKE records the
 15command in gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.
 16"""
 17false_positives = [
 18    """
 19    Break-glass debugging or vendor diagnostics may cat credential-adjacent paths. Baseline approved operators and
 20    automation identities, then expand client.user.email exclusions as needed.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-gcp.audit-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "GKE Pod Exec Sensitive File or Credential Path Access"
 28note = """## Triage and analysis
 29
 30### Investigating GKE Pod Exec Sensitive File or Credential Path Access
 31
 32This alert fires when a successful pods/exec API call includes a command matching sensitive path or filename
 33patterns. Review `gcp.audit.labels.command.gke.io/command` for the reconstructed command string.
 34
 35### Possible investigation steps
 36
 37- Identify the actor (`client.user.email`), source IP, and user agent for the exec caller.
 38- Map `gcp.audit.resource_name` (namespace/pod) to a workload owner, image, and change history.
 39- Correlate adjacent activity from the same identity: secret reads, TokenRequest, RBAC writes, or additional execs.
 40- If host-level paths appear, determine whether the workload is privileged, uses hostPath, or runs on break-glass nodes.
 41
 42### False positive analysis
 43
 44- Diagnostic images and vendor agents sometimes read kubeconfig-like or credential paths; baseline stable automation.
 45- Training containers that deliberately demonstrate passwd reads can trigger; scope exceptions to those namespaces.
 46
 47### Response and remediation
 48
 49- If malicious, end the exec session, isolate the pod or node, rotate credentials that could have been read, and
 50  tighten pods/exec RBAC and admission controls.
 51"""
 52setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 53references = [
 54    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.credential-access.steal-serviceaccount-token/",
 55]
 56risk_score = 73
 57rule_id = "0fc705f5-544e-4786-8acc-c73cd74e77cf"
 58severity = "high"
 59tags = [
 60    "Domain: Cloud",
 61    "Domain: Kubernetes",
 62    "Data Source: GCP",
 63    "Data Source: GCP Audit Logs",
 64    "Data Source: Google Cloud Platform",
 65    "Use Case: Threat Detection",
 66    "Tactic: Credential Access",
 67    "Tactic: Execution",
 68    "Resources: Investigation Guide",
 69]
 70timestamp_override = "event.ingested"
 71type = "query"
 72
 73query = '''
 74data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 75event.type:start and
 76event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 77gcp.audit.labels.command.gke.io/command:(
 78  (
 79    *.jks* or *.key* or *.keystore* or *.p12* or *.pem* or
 80    */etc/kubernetes/* or */etc/passwd* or */etc/shadow* or */etc/sudoers* or
 81    */home/*/.aws* or */home/*/.azure* or */home/*/.config/gcloud* or */home/*/.kube* or */home/*/.ssh* or
 82    */proc/*/environ* or
 83    */root/.aws* or */root/.azure* or */root/.config/gcloud* or */root/.kube* or */root/.ssh* or
 84    */var/lib/kubelet/* or */var/run/secrets/* or
 85    */etc/*.conf* and (*credential* or *key* or *password* or *secret* or *token*)
 86  ) and not */etc/resolv.conf*
 87)
 88'''
 89
 90[[rule.threat]]
 91framework = "MITRE ATT&CK"
 92
 93[[rule.threat.technique]]
 94id = "T1552"
 95name = "Unsecured Credentials"
 96reference = "https://attack.mitre.org/techniques/T1552/"
 97
 98[[rule.threat.technique.subtechnique]]
 99id = "T1552.001"
100name = "Credentials In Files"
101reference = "https://attack.mitre.org/techniques/T1552/001/"
102
103[[rule.threat.technique.subtechnique]]
104id = "T1552.007"
105name = "Container API"
106reference = "https://attack.mitre.org/techniques/T1552/007/"
107
108[rule.threat.tactic]
109id = "TA0006"
110name = "Credential Access"
111reference = "https://attack.mitre.org/tactics/TA0006/"
112
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115
116[[rule.threat.technique]]
117id = "T1609"
118name = "Container Administration Command"
119reference = "https://attack.mitre.org/techniques/T1609/"
120
121[rule.threat.tactic]
122id = "TA0002"
123name = "Execution"
124reference = "https://attack.mitre.org/tactics/TA0002/"
125
126[rule.investigation_fields]
127field_names = [
128    "@timestamp",
129    "client.user.email",
130    "source.ip",
131    "user_agent.original",
132    "event.action",
133    "event.outcome",
134    "event.type",
135    "gcp.audit.labels.command.gke.io/command",
136    "gcp.audit.resource_name",
137    "data_stream.namespace",
138]