GKE Anonymous Pod Create/Update/Patch

 1[metadata]
 2creation_date = "2026/07/16"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2026/09/18"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects create, update, or patch of pods by an unauthenticated anonymous GKE identity. Anonymous pod mutation is a
11critical misconfiguration signal and a common path for unauthenticated attackers to deploy workloads or maintain access.
12Includes "system:anonymous" / "system:unauthenticated" and GKE audit rows with a missing principal (seen on
13unauthenticated Unauthorized/forbidden pod writes).
14"""
15false_positives = [
16    """
17    Anonymous pod writes should be rare. If observed from expected automation, anonymous authentication or RBAC for
18    system:anonymous is likely misconfigured and should be remediated rather than broadly excluded.
19    """,
20]
21from = "now-6m"
22index = ["logs-gcp.audit-*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "GKE Anonymous Pod Create/Update/Patch"
26note = """## Triage and analysis
27
28### Investigating GKE Anonymous Pod Create/Update/Patch
29
30Anonymous identities creating or mutating pods indicates the API server accepts unauthenticated workload changes.
31Failed unauthenticated creates may appear with an empty `client.user.email` and `Unauthorized` / forbidden status.
32
33### Investigation steps
34
35- Review `client.user.email`, `event.action`, `event.outcome`, `orchestrator.resource.name`, `orchestrator.namespace`,
36  and `source.ip`.
37- Inspect the pod image, command, and volume mounts for credential theft or reverse shells.
38- Check whether anonymous authentication is enabled and remove RBAC grants to `system:anonymous`.
39
40### False positives
41
42- Essentially none in production; treat as high-priority misconfiguration until proven otherwise.
43
44"""
45references = [
46    "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#anonymous-requests",
47    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
48]
49risk_score = 73
50rule_id = "92980750-3373-4f0c-aebd-c2a8563d8e8a"
51severity = "high"
52tags = [
53    "Domain: Cloud",
54    "Domain: Kubernetes",
55    "Data Source: GCP",
56    "Data Source: Google Cloud Platform",
57    "Use Case: Threat Detection",
58    "Tactic: Execution",
59    "Resources: Investigation Guide",
60    "Noise: Unknown",
61    "Performance: Fast",
62    "Rule Type: Custom Query (KQL)",
63    "Platform: GCP",
64    "Domain: Containers",
65    "Platform: Kubernetes",
66]
67timestamp_override = "event.ingested"
68type = "query"
69setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
70
71query = '''
72data_stream.dataset:gcp.audit and service.name:k8s.io and client.user.email:("system:anonymous" or "system:unauthenticated" or not *) and event.action:(io.k8s.core.v1.pods.create or io.k8s.core.v1.pods.patch or io.k8s.core.v1.pods.update)
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77
78[[rule.threat.technique]]
79id = "T1610"
80name = "Deploy Container"
81reference = "https://attack.mitre.org/techniques/T1610/"
82
83[rule.threat.tactic]
84id = "TA0002"
85name = "Execution"
86reference = "https://attack.mitre.org/tactics/TA0002/"
87
88[rule.investigation_fields]
89field_names = [
90    "@timestamp",
91    "client.user.email",
92    "source.ip",
93    "user_agent.original",
94    "event.action",
95    "event.outcome",
96    "gcp.audit.resource_name",
97    "orchestrator.resource.name",
98    "orchestrator.namespace",
99]