GKE Forbidden Request from Unusual User Agent

  1[metadata]
  2creation_date = "2026/07/16"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first occurrence of a failed GKE API request from a previously unseen user agent. Adversary tooling often
 11uses non-standard clients; combined with authorization failures this can indicate RBAC probing or exploitation attempts.
 12"""
 13false_positives = [
 14    """
 15    New internal tools, SDKs, or CI runners introduce novel user agents. Baseline expected clients, then exclude stable
 16    automation UAs after review.
 17    """,
 18]
 19from = "now-6m"
 20index = ["logs-gcp.audit-*"]
 21language = "kuery"
 22license = "Elastic License v2"
 23name = "GKE Forbidden Request from Unusual User Agent"
 24note = """## Triage and analysis
 25
 26### Investigating GKE Forbidden Request from Unusual User Agent
 27
 28A novel user agent with failed API calls may be scanner or post-compromise tooling probing RBAC.
 29
 30### Investigation steps
 31
 32- Review `user_agent.original`, `client.user.email`, `event.action`, `gcp.audit.resource_name`, and `source.ip`.
 33- Determine whether the client is expected (new SDK, CI image) or external reconnaissance.
 34- Hunt for successful requests from the same UA or source after the failures.
 35
 36### False positives
 37
 38- First use of a legitimate new client library; add a scoped UA exception after validation.
 39
 40"""
 41references = [
 42    "https://kubernetes.io/docs/reference/access-authn-authz/authorization/",
 43    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
 44]
 45risk_score = 47
 46rule_id = "e1147459-a3e1-4bdc-bab9-965807801774"
 47severity = "medium"
 48tags = [
 49    "Domain: Cloud",
 50    "Domain: Kubernetes",
 51    "Data Source: GCP",
 52    "Data Source: Google Cloud Platform",
 53    "Use Case: Threat Detection",
 54    "Tactic: Execution",
 55    "Tactic: Discovery",
 56    "Resources: Investigation Guide",
 57    "Noise: Low",
 58    "Performance: Fast",
 59    "Rule Type: New Terms",
 60    "Platform: GCP",
 61    "Domain: Containers",
 62    "Platform: Kubernetes",
 63]
 64timestamp_override = "event.ingested"
 65type = "new_terms"
 66setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 67
 68query = '''
 69data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
 70user_agent.original:(* and not (*kubernetes/$Format or kube-probe* or gke-exec-auth-plugin*)) and
 71not client.user.email:(
 72  "system:addon-manager" or system\:*controller* or system\:gke-* or
 73  "system:apiserver" or "system:kube-scheduler" or "system:metrics-server-nanny" or
 74  "system:kube-proxy" or "system:clustermetrics" or "system:vpa-recommender" or
 75  "system:cluster-autoscaler" or "system:kubestore-collector" or
 76  "system:konnectivity-server" or
 77  "system:serviceaccount:kube-system:pod-garbage-collector" or
 78  "system:serviceaccount:kube-system:generic-garbage-collector" or system\:node\:* or
 79  "gcp:kube-bootstrap" or *container-engine-robot*
 80)
 81'''
 82
 83[rule.new_terms]
 84field = "new_terms_fields"
 85value = ["user_agent.original"]
 86
 87[[rule.new_terms.history_window_start]]
 88field = "history_window_start"
 89value = "now-7d"
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93
 94[rule.threat.tactic]
 95id = "TA0002"
 96name = "Execution"
 97reference = "https://attack.mitre.org/tactics/TA0002/"
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101
102[[rule.threat.technique]]
103id = "T1613"
104name = "Container and Resource Discovery"
105reference = "https://attack.mitre.org/techniques/T1613/"
106
107[rule.threat.tactic]
108id = "TA0007"
109name = "Discovery"
110reference = "https://attack.mitre.org/tactics/TA0007/"
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "client.user.email",
116    "source.ip",
117    "user_agent.original",
118    "event.action",
119    "event.outcome",
120    "gcp.audit.resource_name",
121    "orchestrator.resource.name",
122    "orchestrator.namespace",
123]