GKE Forbidden Creation Request

 1[metadata]
 2creation_date = "2026/07/16"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2026/07/16"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing,
11stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads.
12"""
13false_positives = [
14    """
15    Developers or CI jobs with incomplete RBAC can generate denied creates. Tune after validating expected identities
16    and namespaces. GKE control-plane and bootstrap identities are excluded.
17    """,
18]
19from = "now-6m"
20index = ["logs-gcp.audit-*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "GKE Forbidden Creation Request"
24note = """## Triage and analysis
25
26### Investigating GKE Forbidden Creation Request
27
28Denied creates outside GKE system identities often reflect reconnaissance or misconfigured automation with stolen tokens.
29
30### Investigation steps
31
32- Review `client.user.email`, `event.action`, `gcp.audit.resource_name`, `source.ip`, `user_agent.original`, and `gcp.audit.status.message`.
33- Determine whether the identity should exist and whether the target resource is sensitive (pods, secrets, RBAC).
34- Correlate with later successful creates or RBAC changes from the same actor.
35
36### False positives
37
38- New deployments where RoleBindings lag the workload; exclude approved CI service accounts after review.
39
40"""
41references = [
42    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
43    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
44]
45risk_score = 47
46rule_id = "a76f049d-97fb-4058-9379-1bd985d523c2"
47severity = "medium"
48tags = [
49    "Domain: Cloud",
50    "Domain: Kubernetes",
51    "Data Source: GCP",
52    "Data Source: Google Cloud Platform",
53    "Use Case: Threat Detection",
54    "Tactic: Execution",
55    "Resources: Investigation Guide",
56]
57timestamp_override = "event.ingested"
58type = "query"
59setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
60
61query = '''
62data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
63event.action:*.create and
64gcp.audit.status.message:(*forbidden* or *Unauthorized*) and
65not client.user.email:(
66  "system:apiserver" or system\:kube-* or "system:cloud-controller-manager" or system\:gke-* or
67  system\:node\:* or system\:serviceaccount\:kube-system\:* or system\:serviceaccount\:gke-managed* or
68  "kubelet-bootstrap" or "kubelet-nodepool-bootstrap" or "gcp:kube-bootstrap"
69) and
70not user_agent.original:(*kubernetes/$Format)
71'''
72
73[[rule.threat]]
74framework = "MITRE ATT&CK"
75
76[rule.threat.tactic]
77id = "TA0002"
78name = "Execution"
79reference = "https://attack.mitre.org/tactics/TA0002/"
80
81[rule.investigation_fields]
82field_names = [
83    "@timestamp",
84    "client.user.email",
85    "source.ip",
86    "user_agent.original",
87    "event.action",
88    "event.outcome",
89    "gcp.audit.status.message",
90    "gcp.audit.resource_name",
91    "orchestrator.resource.name",
92    "orchestrator.namespace",
93]