GKE Forbidden Creation Request

 1[metadata]
 2creation_date = "2026/07/16"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2026/09/18"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing,
11stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads.
12"""
13false_positives = [
14    """
15    Developers or CI jobs with incomplete RBAC can generate denied creates. Tune after validating expected identities
16    and namespaces. GKE control-plane and bootstrap identities are excluded.
17    """,
18]
19from = "now-6m"
20index = ["logs-gcp.audit-*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "GKE Forbidden Creation Request"
24note = """## Triage and analysis
25
26### Investigating GKE Forbidden Creation Request
27
28Denied creates outside GKE system identities often reflect reconnaissance or misconfigured automation with stolen tokens.
29
30### Investigation steps
31
32- Review `client.user.email`, `event.action`, `gcp.audit.resource_name`, `source.ip`, `user_agent.original`, and `gcp.audit.status.message`.
33- Determine whether the identity should exist and whether the target resource is sensitive (pods, secrets, RBAC).
34- Correlate with later successful creates or RBAC changes from the same actor.
35
36### False positives
37
38- New deployments where RoleBindings lag the workload; exclude approved CI service accounts after review.
39
40"""
41references = [
42    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
43    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
44]
45risk_score = 47
46rule_id = "a76f049d-97fb-4058-9379-1bd985d523c2"
47severity = "medium"
48tags = [
49    "Domain: Cloud",
50    "Domain: Kubernetes",
51    "Data Source: GCP",
52    "Data Source: Google Cloud Platform",
53    "Use Case: Threat Detection",
54    "Tactic: Execution",
55    "Resources: Investigation Guide",
56    "Noise: Medium",
57    "Performance: Fast",
58    "Rule Type: Custom Query (KQL)",
59    "Platform: GCP",
60    "Domain: Containers",
61    "Platform: Kubernetes",
62]
63timestamp_override = "event.ingested"
64type = "query"
65setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
66
67query = '''
68data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
69event.action:*.create and
70gcp.audit.status.message:(*forbidden* or *Unauthorized*) and
71not client.user.email:(
72  "system:apiserver" or system\:kube-* or "system:cloud-controller-manager" or system\:gke-* or
73  system\:node\:* or system\:serviceaccount\:kube-system\:* or system\:serviceaccount\:gke-managed* or
74  "kubelet-bootstrap" or "kubelet-nodepool-bootstrap" or "gcp:kube-bootstrap"
75) and
76not user_agent.original:(*kubernetes/$Format)
77'''
78
79[[rule.threat]]
80framework = "MITRE ATT&CK"
81
82[rule.threat.tactic]
83id = "TA0002"
84name = "Execution"
85reference = "https://attack.mitre.org/tactics/TA0002/"
86
87[rule.investigation_fields]
88field_names = [
89    "@timestamp",
90    "client.user.email",
91    "source.ip",
92    "user_agent.original",
93    "event.action",
94    "event.outcome",
95    "gcp.audit.status.message",
96    "gcp.audit.resource_name",
97    "orchestrator.resource.name",
98    "orchestrator.namespace",
99]