GKE Secrets List from Unusual Source AS Organization

  1[metadata]
  2creation_date = "2026/06/30"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/06/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first time a human GKE caller lists secrets cluster-wide or in default or kube-system from a source
 11autonomous system that is not attributed to common cloud provider organizations. This can indicate remote secret
 12enumeration using stolen credentials from an unusual network.
 13"""
 14false_positives = [
 15    """
 16    Engineers listing secrets from home ISP or corporate VPN AS names may match until baselined. GeoIP organization
 17  labels vary by vendor; tune exclusions after validation.
 18    """,
 19]
 20from = "now-6m"
 21index = ["logs-gcp.audit-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "GKE Secrets List from Unusual Source AS Organization"
 25note = """## Triage and analysis
 26
 27### Investigating GKE Secrets List from Unusual Source AS Organization
 28
 29New-terms rule on `user.email` and `source.as.number` for cluster-wide or sensitive namespace secret list operations.
 30
 31### Investigation steps
 32
 33- Confirm `gcp.audit.resource_name` and whether listing was authorized.
 34- Review `source.ip`, `source.as.organization.name`, and follow-on secret get or exec activity.
 35
 36### False positives
 37
 38- First-time legitimate admin access from a new office or VPN provider.
 39
 40## Setup
 41
 42The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
 43references = [
 44    "https://attack.mitre.org/techniques/T1552/007/",
 45]
 46risk_score = 73
 47rule_id = "4df2e3ae-3553-4194-b22e-3e5a6f71466e"
 48severity = "high"
 49tags = [
 50    "Domain: Cloud",
 51    "Domain: Kubernetes",
 52    "Data Source: GCP",
 53    "Data Source: Google Cloud Platform",
 54    "Use Case: Threat Detection",
 55    "Tactic: Credential Access",
 56    "Tactic: Discovery",
 57    "Resources: Investigation Guide",
 58]
 59timestamp_override = "event.ingested"
 60type = "new_terms"
 61
 62query = '''
 63data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.action:io.k8s.core.v1.secrets.list and gcp.audit.resource_name:(core/v1/namespaces/default/secrets or core/v1/namespaces/kube-system/secrets or core/v1/secrets) and user.email:*@* and source.as.organization.name:(* and not ("Google LLC" or "Microsoft Corporation")) and source.as.number:*
 64'''
 65
 66[rule.new_terms]
 67field = "new_terms_fields"
 68value = ["user.email", "source.as.number"]
 69
 70[[rule.new_terms.history_window_start]]
 71field = "history_window_start"
 72value = "now-7d"
 73
 74[[rule.threat]]
 75framework = "MITRE ATT&CK"
 76
 77[[rule.threat.technique]]
 78id = "T1552"
 79name = "Unsecured Credentials"
 80reference = "https://attack.mitre.org/techniques/T1552/"
 81
 82[[rule.threat.technique.subtechnique]]
 83id = "T1552.007"
 84name = "Container API"
 85reference = "https://attack.mitre.org/techniques/T1552/007/"
 86
 87[rule.threat.tactic]
 88id = "TA0006"
 89name = "Credential Access"
 90reference = "https://attack.mitre.org/tactics/TA0006/"
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94
 95[[rule.threat.technique]]
 96id = "T1613"
 97name = "Container and Resource Discovery"
 98reference = "https://attack.mitre.org/techniques/T1613/"
 99
100[rule.threat.tactic]
101id = "TA0007"
102name = "Discovery"
103reference = "https://attack.mitre.org/tactics/TA0007/"