GKE Service Account Token Created via TokenRequest API

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects creation of a GKE service account token through the TokenRequest API by a non-system identity. TokenRequest
 11allows programmatic minting of short-lived tokens for any service account the caller can create tokens for, without
 12reading a mounted projected token from disk. Attackers with initial cluster access can abuse this API to obtain tokens
 13for more privileged service accounts, pivot via Workload Identity to GCP APIs, or retain access after pod termination.
 14Unlike filesystem token theft, TokenRequest activity is visible only in Kubernetes audit logs as create against the
 15serviceaccounts/token subresource.
 16"""
 17false_positives = [
 18    """
 19    Platform agents, admission webhooks, and CI jobs may legitimately call TokenRequest under non-standard identities.
 20    Baseline approved automation by client.user.email after validation. Expected GKE and kube-system controllers are
 21    excluded; expand exclusions if additional managed components appear in telemetry.
 22    """,
 23]
 24from = "now-6m"
 25index = ["logs-gcp.audit-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "GKE Service Account Token Created via TokenRequest API"
 29note = """## Triage and analysis
 30
 31### Investigating GKE Service Account Token Created via TokenRequest API
 32
 33This alert indicates a successful create against the serviceaccounts/token subresource (TokenRequest API), which issues
 34a new service account token without a filesystem read. On GKE this can be abused to mint tokens for privileged service
 35accounts — including those bound through Workload Identity — and pivot to GCP APIs.
 36
 37### Possible investigation steps
 38
 39- Review `client.user.email`, `source.ip`, and `user_agent.original`.
 40- Identify the targeted service account from `gcp.audit.resource_name` (typically
 41  `core/v1/namespaces/<ns>/serviceaccounts/<sa>/token`).
 42- Determine which Role or ClusterRoleBindings grant the actor `create` on `serviceaccounts/token`.
 43- Correlate the same actor and source with follow-on secret reads, pod exec, RBAC changes, or GCP API activity via
 44  Workload Identity.
 45
 46### False positive analysis
 47
 48- New platform automation that mints projected tokens outside the excluded controllers may match. Allowlist after
 49  confirming expected behavior.
 50
 51### Response and remediation
 52
 53- If unauthorized, remove or revert RBAC that allows TokenRequest and rotate the affected service account credentials.
 54- For Workload Identity-linked service accounts, revoke related GCP role sessions and review Cloud Audit Logs in the
 55  same window.
 56
 57"""
 58setup = """
 59The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.
 60"""
 61references = [
 62    "https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-v1/",
 63    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.persistence.create-token/",
 64]
 65risk_score = 47
 66rule_id = "5d505bed-6d0e-4afa-b445-64841d4b8c58"
 67severity = "medium"
 68tags = [
 69    "Domain: Cloud",
 70    "Domain: Kubernetes",
 71    "Data Source: GCP",
 72    "Data Source: Google Cloud Platform",
 73    "Use Case: Threat Detection",
 74    "Tactic: Credential Access",
 75    "Resources: Investigation Guide",
 76]
 77timestamp_override = "event.ingested"
 78type = "query"
 79
 80query = '''
 81data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 82event.action:"io.k8s.core.v1.serviceaccounts.token.create" and
 83client.user.email:(* and not (
 84  "system:kube-controller-manager" or
 85  "system:kube-scheduler" or
 86  "system:gke-controller-manager" or
 87  "system:gcp-controller-manager" or
 88  system\:node\:* or
 89  system\:serviceaccount\:kube-system\:* or
 90  system\:serviceaccount\:gke-managed-system\:* or
 91  system\:serviceaccount\:gke-connect\:* or
 92  system\:serviceaccount\:anthos-identity-service\:*
 93))
 94'''
 95
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98
 99[[rule.threat.technique]]
100id = "T1552"
101name = "Unsecured Credentials"
102reference = "https://attack.mitre.org/techniques/T1552/"
103
104[[rule.threat.technique.subtechnique]]
105id = "T1552.007"
106name = "Container API"
107reference = "https://attack.mitre.org/techniques/T1552/007/"
108
109[rule.threat.tactic]
110id = "TA0006"
111name = "Credential Access"
112reference = "https://attack.mitre.org/tactics/TA0006/"
113
114[rule.investigation_fields]
115field_names = [
116    "@timestamp",
117    "client.user.email",
118    "source.ip",
119    "user_agent.original",
120    "event.action",
121    "event.outcome",
122    "gcp.audit.resource_name",
123    "gcp.audit.request",
124    "data_stream.namespace",
125]