GKE API Server Proxying Request to Kubelet

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects non-system identities using the GKE nodes/proxy API to reach a node's Kubelet through the API server. The
 11nodes/proxy subresource allows any principal with this permission to call the Kubelet API without direct node network
 12access or Kubelet TLS certificates. Through this path an attacker can list pod specs (including environment secrets),
 13read Kubelet configuration, retrieve container logs, and access running pod metadata on the target node. Monitoring
 14endpoints such as metrics, healthz, and stats/summary are excluded to reduce noise from observability tooling.
 15"""
 16false_positives = [
 17    """
 18    Legitimate kubelet debugging, node troubleshooting, or security tooling that uses the node proxy outside the
 19    excluded metrics paths may match. Baseline approved operators and automation identities after review.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE API Server Proxying Request to Kubelet"
 27note = """## Triage and analysis
 28
 29### Investigating GKE API Server Proxying Request to Kubelet
 30
 31Review `client.user.email`, `source.ip`, and `user_agent.original` to determine who initiated the proxy request.
 32Examine `gcp.audit.resource_name` and `event.action` to identify which Kubelet path was accessed after `/proxy/`.
 33
 34### Possible investigation steps
 35
 36- Check the proxied Kubelet path for attacker intent:
 37  - `/proxy/pods` — pod spec enumeration, including environment variable secrets
 38  - `/proxy/exec` or `/proxy/run` — command execution inside containers on that node
 39  - `/proxy/configz` — Kubelet configuration and authentication settings
 40  - `/proxy/runningpods` — active workload enumeration
 41  - `/proxy/containerLogs` — log harvesting for leaked credentials
 42- Identify how the principal obtained `nodes/proxy` permission by reviewing RBAC bindings.
 43- Correlate with TokenRequest activity from the same actor shortly before the proxy call.
 44- Review whether the same principal proxied multiple nodes in a short window.
 45
 46### False positive analysis
 47
 48- Monitoring agents that scrape paths other than the excluded metrics/health endpoints may match. Add approved paths
 49  or identities after baselining.
 50- Cluster admin tools that inspect node health via the proxy API can match during maintenance windows.
 51
 52### Response and remediation
 53
 54- Review and remove unauthorized RBAC granting `nodes/proxy`.
 55- If `/proxy/pods` was accessed, rotate secrets and credentials that may have been exposed via environment variables
 56  on that node.
 57- If `/proxy/exec` or `/proxy/run` was accessed, treat the node as compromised and isolate it.
 58- Restrict `nodes/proxy` to infrastructure automation only.
 59
 60"""
 61setup = """
 62The GCP Fleet integration with GKE audit logs enabled is required.
 63"""
 64references = [
 65    "https://kubernetes.io/docs/concepts/cluster-administration/proxies/",
 66    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/",
 67]
 68risk_score = 47
 69rule_id = "a4fa2bf0-1cf9-4803-bed0-1f9c6e57af3c"
 70severity = "medium"
 71tags = [
 72    "Domain: Cloud",
 73    "Domain: Kubernetes",
 74    "Data Source: GCP",
 75    "Data Source: Google Cloud Platform",
 76    "Use Case: Threat Detection",
 77    "Tactic: Privilege Escalation",
 78    "Tactic: Lateral Movement",
 79    "Tactic: Discovery",
 80    "Resources: Investigation Guide",
 81]
 82timestamp_override = "event.ingested"
 83type = "query"
 84
 85query = '''
 86data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 87event.action:(
 88  "io.k8s.core.v1.nodes.proxy.get" or
 89  "io.k8s.core.v1.nodes.proxy.create"
 90) and
 91not gcp.audit.resource_name:(*metrics* or *healthz* or *stats/summary* or *elastic-agent* or *configz*) and
 92not client.user.email:(
 93  "system:kube-controller-manager" or
 94  "system:kube-scheduler" or
 95  system\:serviceaccount\:kube-system\:* or
 96  system\:node\:*
 97)
 98'''
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102
103[[rule.threat.technique]]
104id = "T1611"
105name = "Escape to Host"
106reference = "https://attack.mitre.org/techniques/T1611/"
107
108[rule.threat.tactic]
109id = "TA0004"
110name = "Privilege Escalation"
111reference = "https://attack.mitre.org/tactics/TA0004/"
112
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115
116[[rule.threat.technique]]
117id = "T1550"
118name = "Use Alternate Authentication Material"
119reference = "https://attack.mitre.org/techniques/T1550/"
120
121[[rule.threat.technique.subtechnique]]
122id = "T1550.001"
123name = "Application Access Token"
124reference = "https://attack.mitre.org/techniques/T1550/001/"
125
126[rule.threat.tactic]
127id = "TA0008"
128name = "Lateral Movement"
129reference = "https://attack.mitre.org/tactics/TA0008/"
130
131[[rule.threat]]
132framework = "MITRE ATT&CK"
133
134[[rule.threat.technique]]
135id = "T1613"
136name = "Container and Resource Discovery"
137reference = "https://attack.mitre.org/techniques/T1613/"
138
139[rule.threat.tactic]
140id = "TA0007"
141name = "Discovery"
142reference = "https://attack.mitre.org/tactics/TA0007/"
143
144[rule.investigation_fields]
145field_names = [
146    "@timestamp",
147    "client.user.email",
148    "source.ip",
149    "user_agent.original",
150    "event.action",
151    "event.outcome",
152    "gcp.audit.resource_name",
153    "data_stream.namespace",
154]