GKE Pod Exec with Curl or Wget to HTTPS

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions where the executed command implies curl or wget fetching an HTTPS URL.
 11Attackers with pods/exec often run one-liners to stage tooling, pull scripts or binaries, or exfiltrate data over
 12HTTPS—activity that should be rare compared to shells, debuggers, or expected health checks. Common cluster health,
 13localhost, and OIDC/JWKS endpoint patterns are excluded to reduce benign automation noise. GKE records the command in
 14gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.
 15"""
 16false_positives = [
 17    """
 18    Approved runbooks or support sessions may use kubectl exec with curl/wget to test egress or download vendor tools.
 19    """,
 20]
 21from = "now-6m"
 22index = ["logs-gcp.audit-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "GKE Pod Exec with Curl or Wget to HTTPS"
 26note = """## Triage and analysis
 27
 28### Investigating GKE Pod Exec with Curl or Wget to HTTPS
 29
 30This alert fires when a successful pods/exec API call includes a curl or wget command targeting HTTPS.
 31Review `gcp.audit.labels.command.gke.io/command` for the full command and destination URL.
 32
 33### Possible investigation steps
 34
 35- Confirm who may exec into the target namespace: `client.user.email`, source IP, and user agent (kubectl, CI, automation).
 36- Map `gcp.audit.resource_name` to the pod/workload owner and retrieve the exact command from the alert document.
 37- Search for adjacent audit events from the same identity: secret reads, additional execs, RBAC changes, or anonymous access.
 38- If malicious, revoke credentials used for exec, review RoleBindings for pods/exec, and inspect the pod for dropped artifacts.
 39
 40### False positive analysis
 41
 42- Approved egress or tool-download tests may match; allowlist those identities after validation.
 43- Some cluster components use HTTPS to kubernetes.default.svc or .well-known endpoints; expand exclusions if needed.
 44
 45### Response and remediation
 46
 47- Rotate secrets accessible from the pod, cordon or delete the workload if compromised, and tighten RBAC so only
 48  required principals retain pods/exec on sensitive namespaces.
 49"""
 50setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 51references = [
 52    "https://attack.mitre.org/techniques/T1609/",
 53    "https://attack.mitre.org/techniques/T1105/",
 54]
 55risk_score = 73
 56rule_id = "3a68325b-6169-44c1-a5f0-0102ef82b6f1"
 57severity = "high"
 58tags = [
 59    "Domain: Cloud",
 60    "Domain: Kubernetes",
 61    "Data Source: GCP",
 62    "Data Source: GCP Audit Logs",
 63    "Data Source: Google Cloud Platform",
 64    "Use Case: Threat Detection",
 65    "Tactic: Execution",
 66    "Tactic: Command and Control",
 67    "Resources: Investigation Guide",
 68]
 69timestamp_override = "event.ingested"
 70type = "query"
 71
 72query = '''
 73data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 74event.type:start and
 75event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 76gcp.audit.labels.command.gke.io/command:(
 77  (*curl*https* or *wget*https*) and not (
 78    */.well-known/jwks.json* or */.well-known/openid-configuration* or
 79    */api/v1/health* or */healthz* or */livez* or */readyz* or
 80    */openid-connect/certs* or */openid/v1/jwks* or
 81    *127.0.0.1* or *kubernetes.default.svc* or *localhost*
 82  )
 83)
 84'''
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88
 89[[rule.threat.technique]]
 90id = "T1609"
 91name = "Container Administration Command"
 92reference = "https://attack.mitre.org/techniques/T1609/"
 93
 94[rule.threat.tactic]
 95id = "TA0002"
 96name = "Execution"
 97reference = "https://attack.mitre.org/tactics/TA0002/"
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101
102[[rule.threat.technique]]
103id = "T1105"
104name = "Ingress Tool Transfer"
105reference = "https://attack.mitre.org/techniques/T1105/"
106
107[rule.threat.tactic]
108id = "TA0011"
109name = "Command and Control"
110reference = "https://attack.mitre.org/tactics/TA0011/"
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "client.user.email",
116    "source.ip",
117    "user_agent.original",
118    "event.action",
119    "event.outcome",
120    "event.type",
121    "gcp.audit.labels.command.gke.io/command",
122    "gcp.audit.resource_name",
123    "data_stream.namespace",
124]