GKE Exposed Service Created With Type NodePort

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects creation or modification of a GKE Service with type NodePort. NodePort exposes a static port on every worker
 11node that hosts matching pods, which widens the cluster's external attack surface and can bypass load-balancer and
 12firewall controls. Attackers may create NodePort Services to intercept traffic or establish a direct path into the
 13cluster.
 14"""
 15false_positives = [
 16    """
 17    Developers may legitimately use NodePort for frontends without cloud load balancers, or for nonstandard networking.
 18    system:addon-manager patch reconciliation of existing NodePort Services is excluded; create and update from
 19    addon-manager still alert.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE Exposed Service Created With Type NodePort"
 27note = """## Triage and analysis
 28
 29### Investigating GKE Exposed Service Created With Type NodePort
 30
 31NodePort opens a port on each worker node hosting the service and forwards external traffic to labeled pods. Confirm
 32whether the exposure was approved and which workloads are reachable.
 33
 34### Possible investigation steps
 35
 36- Review `client.user.email`, `source.ip`, and `user_agent.original`.
 37- Inspect `gcp.audit.resource_name` and `gcp.audit.request` for the service name, namespace, selector, and port.
 38- Identify the backing pods and whether the NodePort is required for a legitimate external entrypoint.
 39- Correlate with recent Service or networking changes from the same actor.
 40
 41### False positive analysis
 42
 43- Approved NodePort Services for lab frontends or custom load balancing may match. Allowlist known automation or
 44  namespaces after review.
 45- GKE addon reconciliation via `system:addon-manager` patch is excluded; unexpected create or update from that actor
 46  should still be investigated.
 47
 48### Response and remediation
 49
 50- Remove or change unauthorized NodePort Services, revoke excess RBAC for Services writes, and review firewall exposure
 51  for the opened node ports.
 52
 53"""
 54setup = """
 55The GCP Fleet integration with GKE audit logs enabled is required. Request body capture for Service resources is
 56required so `gcp.audit.request.spec.type` is populated.
 57"""
 58references = [
 59    "https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types",
 60    "https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport",
 61    "https://www.tigera.io/blog/new-vulnerability-exposes-kubernetes-to-man-in-the-middle-attacks-heres-how-to-mitigate/",
 62]
 63risk_score = 47
 64rule_id = "05ac190c-5d02-4b81-bb57-221d33479570"
 65severity = "medium"
 66tags = [
 67    "Domain: Cloud",
 68    "Domain: Kubernetes",
 69    "Data Source: GCP",
 70    "Data Source: Google Cloud Platform",
 71    "Use Case: Threat Detection",
 72    "Tactic: Persistence",
 73    "Tactic: Initial Access",
 74    "Resources: Investigation Guide",
 75]
 76timestamp_override = "event.ingested"
 77type = "query"
 78
 79query = '''
 80data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 81event.action:(
 82  "io.k8s.core.v1.services.create" or
 83  "io.k8s.core.v1.services.update" or
 84  "io.k8s.core.v1.services.patch"
 85) and gcp.audit.request.spec.type:"NodePort" and not (
 86  client.user.email:"system:addon-manager" and
 87  event.action:"io.k8s.core.v1.services.patch"
 88)
 89'''
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93
 94[[rule.threat.technique]]
 95id = "T1133"
 96name = "External Remote Services"
 97reference = "https://attack.mitre.org/techniques/T1133/"
 98
 99[rule.threat.tactic]
100id = "TA0003"
101name = "Persistence"
102reference = "https://attack.mitre.org/tactics/TA0003/"
103
104[[rule.threat]]
105framework = "MITRE ATT&CK"
106
107[[rule.threat.technique]]
108id = "T1133"
109name = "External Remote Services"
110reference = "https://attack.mitre.org/techniques/T1133/"
111
112[rule.threat.tactic]
113id = "TA0001"
114name = "Initial Access"
115reference = "https://attack.mitre.org/tactics/TA0001/"
116
117[rule.investigation_fields]
118field_names = [
119    "@timestamp",
120    "client.user.email",
121    "source.ip",
122    "user_agent.original",
123    "event.action",
124    "event.outcome",
125    "gcp.audit.resource_name",
126    "gcp.audit.request.spec.type",
127    "gcp.audit.request",
128    "data_stream.namespace",
129]