GKE Secret get or list with Suspicious User Agent

 1[metadata]
 2creation_date = "2026/06/30"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2026/09/18"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects successful GKE secret get or list operations where the user agent matches scripting runtimes, minimal HTTP
11clients, or offensive-distribution fingerprints rather than typical kubectl or controller traffic.
12"""
13false_positives = [
14    """
15    Approved scripts, CI jobs, or penetration tests may use generic HTTP clients. Validate tickets and identity scope
16    before treating as compromise.
17    """,
18]
19index = ["logs-gcp.audit-*"]
20language = "kuery"
21license = "Elastic License v2"
22name = "GKE Secret get or list with Suspicious User Agent"
23note = """## Triage and analysis
24
25### Investigating GKE Secret get or list with Suspicious User Agent
26
27Review `user.email`, `user_agent.original`, targeted secret resource, and `source.ip`.
28
29### Investigation steps
30
31- Confirm whether the identity should access secrets with this client fingerprint.
32- Pivot on source IP for other API bursts, exec, or RBAC changes.
33
34### False positives
35
36- Internal automation using generic libraries; exclude stable service accounts after review.
37
38## Setup
39
40The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
41references = [
42    "https://attack.mitre.org/techniques/T1552/007/",
43]
44risk_score = 73
45rule_id = "0c04d82f-6def-4659-aa62-ed6355a51f39"
46severity = "high"
47tags = [
48    "Domain: Cloud",
49    "Domain: Kubernetes",
50    "Data Source: GCP",
51    "Data Source: Google Cloud Platform",
52    "Use Case: Threat Detection",
53    "Tactic: Credential Access",
54    "Resources: Investigation Guide",
55    "Noise: Low",
56    "Performance: Fast",
57    "Profile: Recommended",
58    "Rule Type: Custom Query (KQL)",
59    "Platform: GCP",
60    "Domain: Containers",
61    "Platform: Kubernetes",
62]
63timestamp_override = "event.ingested"
64type = "query"
65
66query = '''
67data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
68event.action:("io.k8s.core.v1.secrets.list" or "io.k8s.core.v1.secrets.get") and user_agent.original:(
69  curl* or python* or Python* or wget* or Go-http* or perl* or java* or node* or php* or *distrib#kali* or *kali-amd64* or
70  *kali-arm64* or Bun* or axios* or undici*
71)
72'''
73
74[[rule.threat]]
75framework = "MITRE ATT&CK"
76
77[[rule.threat.technique]]
78id = "T1552"
79name = "Unsecured Credentials"
80reference = "https://attack.mitre.org/techniques/T1552/"
81
82[[rule.threat.technique.subtechnique]]
83id = "T1552.007"
84name = "Container API"
85reference = "https://attack.mitre.org/techniques/T1552/007/"
86
87[rule.threat.tactic]
88id = "TA0006"
89name = "Credential Access"
90reference = "https://attack.mitre.org/tactics/TA0006/"