GKE Secret Access via Unusual User Agent

  1[metadata]
  2creation_date = "2026/07/22"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects GKE secrets get or list requests from a previously unseen combination of source IP, identity, and user agent,
 11excluding the default Kubernetes client placeholder. Attackers who compromise a pod or steal a kubeconfig often use
 12curl, custom scripts, or atypical clients from a new host to read service-account tokens, registry credentials, or
 13application secrets. Anonymous identities are excluded; use dedicated anonymous-access rules for unauthenticated
 14probing.
 15"""
 16false_positives = [
 17    """
 18    Administrators or CI jobs using a new workstation, bastion, VPN egress, or nonstandard API client can produce a
 19    first-seen alert; confirm against change records and expected automation.
 20    """,
 21    """
 22    Workloads or operators that change client libraries after a deploy may introduce a new user agent for an otherwise
 23    known identity; baseline after validation.
 24    """,
 25]
 26from = "now-6m"
 27index = ["logs-gcp.audit-*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "GKE Secret Access via Unusual User Agent"
 31note = """## Triage and analysis
 32
 33### Investigating GKE Secret Access via Unusual User Agent
 34
 35This new-terms rule alerts on secrets `get`/`list` when the (`source.ip`, `client.user.email`, `user_agent.original`)
 36triple is new in the history window.
 37
 38### Possible investigation steps
 39
 40- Review `client.user.email`, `source.ip`, `user_agent.original`, and `gcp.audit.resource_name` for the secret and
 41  namespace accessed.
 42- Determine whether the client fingerprint matches an approved admin path, CI runner, or controller upgrade.
 43- Pivot on the same identity or IP for secret bursts, pod exec, token creation, or RBAC changes.
 44
 45### False positive analysis
 46
 47- New admin workstations, VPN egress IPs, or SDK version bumps can first-seen alert; tune after confirming ownership.
 48- First enablement surfaces legitimate clients until the history window fills.
 49
 50### Response and remediation
 51
 52- If malicious, revoke the credential, rotate exposed secrets, isolate the source host or workload, and tighten who
 53  can read secrets.
 54"""
 55setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 56references = [
 57    "https://attack.mitre.org/techniques/T1552/007/",
 58]
 59risk_score = 21
 60rule_id = "854e89c1-f70c-4180-bc53-65999df9d3c3"
 61severity = "low"
 62tags = [
 63    "Domain: Cloud",
 64    "Domain: Kubernetes",
 65    "Data Source: GCP",
 66    "Data Source: Google Cloud Platform",
 67    "Use Case: Threat Detection",
 68    "Tactic: Credential Access",
 69    "Resources: Investigation Guide",
 70    "Noise: High",
 71    "Performance: Fast",
 72    "Profile: Aggressive",
 73    "Rule Type: New Terms",
 74    "Platform: GCP",
 75    "Domain: Containers",
 76    "Platform: Kubernetes",
 77]
 78timestamp_override = "event.ingested"
 79type = "new_terms"
 80
 81query = '''
 82data_stream.dataset:gcp.audit and service.name:k8s.io and
 83event.action:("io.k8s.core.v1.secrets.get" or "io.k8s.core.v1.secrets.list") and
 84user_agent.original:(* and not (*kubernetes/$Format* or kube-probe* or gke-exec-auth-plugin*)) and
 85source.ip:(* and not (127.0.0.1 or "::1")) and
 86client.user.email:(* and not (
 87  "system:anonymous" or "system:unauthenticated" or "system:addon-manager" or
 88  "system:serviceaccount:kube-system:namespace-controller"
 89))
 90'''
 91
 92[rule.new_terms]
 93field = "new_terms_fields"
 94value = ["source.ip", "client.user.email", "user_agent.original"]
 95
 96[[rule.new_terms.history_window_start]]
 97field = "history_window_start"
 98value = "now-7d"
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102
103[[rule.threat.technique]]
104id = "T1552"
105name = "Unsecured Credentials"
106reference = "https://attack.mitre.org/techniques/T1552/"
107
108[[rule.threat.technique.subtechnique]]
109id = "T1552.007"
110name = "Container API"
111reference = "https://attack.mitre.org/techniques/T1552/007/"
112
113[rule.threat.tactic]
114id = "TA0006"
115name = "Credential Access"
116reference = "https://attack.mitre.org/tactics/TA0006/"
117
118[rule.investigation_fields]
119field_names = [
120    "@timestamp",
121    "client.user.email",
122    "source.ip",
123    "user_agent.original",
124    "event.action",
125    "event.outcome",
126    "gcp.audit.resource_name",
127    "data_stream.namespace",
128]