GKE Anonymous Endpoint Permission Enumeration

  1[metadata]
  2creation_date = "2026/07/16"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/16"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects bursts of GKE API requests from an anonymous identity that probe many distinct actions and resources with
 11mostly failed outcomes. This pattern is consistent with unauthenticated permission enumeration against an exposed API
 12server. On GKE GCP audit logs, unauthenticated probes often omit "client.user.email" (null principal) with
 13Unauthorized failures; those events are included alongside "system:anonymous" / "system:unauthenticated".
 14"""
 15from = "now-6m"
 16interval = "5m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "GKE Anonymous Endpoint Permission Enumeration"
 20note = """## Triage and analysis
 21
 22### Investigating GKE Anonymous Endpoint Permission Enumeration
 23
 24Anonymous multi-endpoint failure bursts map which APIs are reachable before credential theft or exploitation.
 25Treat missing `client.user.email` with Unauthorized/failure bursts as anonymous on GKE.
 26
 27### Investigation steps
 28
 29- Review `Esql.event_action_values` and `Esql.resource_name_values` for targeted APIs (secrets, RBAC, CRDs).
 30- Confirm whether `source.ip` is Internet-routable and whether the API endpoint is publicly exposed.
 31- Hunt for later successful anonymous or authenticated activity from the same source or user agent.
 32
 33### False positives
 34
 35- Misconfigured auth proxies that strip credentials can make legitimate clients appear anonymous during outages.
 36
 37"""
 38references = [
 39    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#unauthenticated-api-access",
 40    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
 41]
 42risk_score = 47
 43rule_id = "bd7345e5-c822-41de-a393-7573fec07ef4"
 44severity = "medium"
 45tags = [
 46    "Domain: Cloud",
 47    "Domain: Kubernetes",
 48    "Data Source: GCP",
 49    "Data Source: Google Cloud Platform",
 50    "Use Case: Threat Detection",
 51    "Tactic: Discovery",
 52    "Tactic: Reconnaissance",
 53    "Resources: Investigation Guide",
 54]
 55timestamp_override = "event.ingested"
 56type = "esql"
 57setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 58
 59query = '''
 60from logs-gcp.audit-* metadata _id, _index, _version
 61| where data_stream.dataset == "gcp.audit"
 62    and service.name == "k8s.io"
 63    and (
 64      client.user.email in ("system:anonymous", "system:unauthenticated")
 65      or client.user.email is null
 66    )
 67    and not gcp.audit.resource_name in ("readyz", "livez", "healthz", "version")
 68| stats
 69    Esql.document_count = count(),
 70    Esql.failure_count = sum(case(event.outcome == "failure", 1, 0)),
 71    Esql.event_action_count_distinct = count_distinct(event.action),
 72    Esql.resource_name_count_distinct = count_distinct(gcp.audit.resource_name),
 73    Esql.event_action_values = values(event.action),
 74    Esql.resource_name_values = values(gcp.audit.resource_name),
 75    Esql.event_outcome_values = values(event.outcome),
 76    Esql.client_user_email_values = values(client.user.email),
 77    Esql.timestamp = VALUES(@timestamp),
 78    Esql.data_stream_namespace = VALUES(data_stream.namespace),
 79    Esql.user_agent_original_values = VALUES(user_agent.original)
 80  by source.ip
 81| where Esql.event_action_count_distinct > 5
 82    and Esql.resource_name_count_distinct > 3
 83    and Esql.document_count < 50
 84    and Esql.failure_count >= 1
 85| keep Esql.*, source.ip
 86'''
 87
 88[[rule.threat]]
 89framework = "MITRE ATT&CK"
 90
 91[[rule.threat.technique]]
 92id = "T1613"
 93name = "Container and Resource Discovery"
 94reference = "https://attack.mitre.org/techniques/T1613/"
 95
 96[rule.threat.tactic]
 97id = "TA0007"
 98name = "Discovery"
 99reference = "https://attack.mitre.org/tactics/TA0007/"
100
101[[rule.threat]]
102framework = "MITRE ATT&CK"
103
104[[rule.threat.technique]]
105id = "T1595"
106name = "Active Scanning"
107reference = "https://attack.mitre.org/techniques/T1595/"
108
109[[rule.threat.technique.subtechnique]]
110id = "T1595.003"
111name = "Wordlist Scanning"
112reference = "https://attack.mitre.org/techniques/T1595/003/"
113
114[rule.threat.tactic]
115id = "TA0043"
116name = "Reconnaissance"
117reference = "https://attack.mitre.org/tactics/TA0043/"