GKE API Server Proxying Request to Kubelet

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects non-system identities using the GKE nodes/proxy API to reach a node's Kubelet through the API server. The
 11nodes/proxy subresource allows any principal with this permission to call the Kubelet API without direct node network
 12access or Kubelet TLS certificates. Through this path an attacker can list pod specs (including environment secrets),
 13read Kubelet configuration, retrieve container logs, and access running pod metadata on the target node. Monitoring
 14endpoints such as metrics, healthz, and stats/summary are excluded to reduce noise from observability tooling.
 15"""
 16false_positives = [
 17    """
 18    Legitimate kubelet debugging, node troubleshooting, or security tooling that uses the node proxy outside the
 19    excluded metrics paths may match. Baseline approved operators and automation identities after review.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE API Server Proxying Request to Kubelet"
 27note = """## Triage and analysis
 28
 29### Investigating GKE API Server Proxying Request to Kubelet
 30
 31Review `client.user.email`, `source.ip`, and `user_agent.original` to determine who initiated the proxy request.
 32Examine `gcp.audit.resource_name` and `event.action` to identify which Kubelet path was accessed after `/proxy/`.
 33
 34### Possible investigation steps
 35
 36- Check the proxied Kubelet path for attacker intent:
 37  - `/proxy/pods` — pod spec enumeration, including environment variable secrets
 38  - `/proxy/exec` or `/proxy/run` — command execution inside containers on that node
 39  - `/proxy/configz` — Kubelet configuration and authentication settings
 40  - `/proxy/runningpods` — active workload enumeration
 41  - `/proxy/containerLogs` — log harvesting for leaked credentials
 42- Identify how the principal obtained `nodes/proxy` permission by reviewing RBAC bindings.
 43- Correlate with TokenRequest activity from the same actor shortly before the proxy call.
 44- Review whether the same principal proxied multiple nodes in a short window.
 45
 46### False positive analysis
 47
 48- Monitoring agents that scrape paths other than the excluded metrics/health endpoints may match. Add approved paths
 49  or identities after baselining.
 50- Cluster admin tools that inspect node health via the proxy API can match during maintenance windows.
 51
 52### Response and remediation
 53
 54- Review and remove unauthorized RBAC granting `nodes/proxy`.
 55- If `/proxy/pods` was accessed, rotate secrets and credentials that may have been exposed via environment variables
 56  on that node.
 57- If `/proxy/exec` or `/proxy/run` was accessed, treat the node as compromised and isolate it.
 58- Restrict `nodes/proxy` to infrastructure automation only.
 59
 60"""
 61setup = """
 62The GCP Fleet integration with GKE audit logs enabled is required.
 63"""
 64references = [
 65    "https://kubernetes.io/docs/concepts/cluster-administration/proxies/",
 66    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/",
 67]
 68risk_score = 47
 69rule_id = "a4fa2bf0-1cf9-4803-bed0-1f9c6e57af3c"
 70severity = "medium"
 71tags = [
 72    "Domain: Cloud",
 73    "Domain: Kubernetes",
 74    "Data Source: GCP",
 75    "Data Source: Google Cloud Platform",
 76    "Use Case: Threat Detection",
 77    "Tactic: Privilege Escalation",
 78    "Tactic: Lateral Movement",
 79    "Tactic: Discovery",
 80    "Resources: Investigation Guide",
 81    "Noise: Unknown",
 82    "Performance: Normal",
 83    "Rule Type: Custom Query (KQL)",
 84    "Platform: GCP",
 85    "Domain: Containers",
 86    "Platform: Kubernetes",
 87]
 88timestamp_override = "event.ingested"
 89type = "query"
 90
 91query = '''
 92data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 93event.action:(
 94  "io.k8s.core.v1.nodes.proxy.get" or
 95  "io.k8s.core.v1.nodes.proxy.create"
 96) and
 97not gcp.audit.resource_name:(*metrics* or *healthz* or *stats/summary* or *elastic-agent* or *configz*) and
 98not client.user.email:(
 99  "system:kube-controller-manager" or
100  "system:kube-scheduler" or
101  system\:serviceaccount\:kube-system\:* or
102  system\:node\:*
103)
104'''
105
106[[rule.threat]]
107framework = "MITRE ATT&CK"
108
109[[rule.threat.technique]]
110id = "T1611"
111name = "Escape to Host"
112reference = "https://attack.mitre.org/techniques/T1611/"
113
114[rule.threat.tactic]
115id = "TA0004"
116name = "Privilege Escalation"
117reference = "https://attack.mitre.org/tactics/TA0004/"
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121
122[[rule.threat.technique]]
123id = "T1550"
124name = "Use Alternate Authentication Material"
125reference = "https://attack.mitre.org/techniques/T1550/"
126
127[[rule.threat.technique.subtechnique]]
128id = "T1550.001"
129name = "Application Access Token"
130reference = "https://attack.mitre.org/techniques/T1550/001/"
131
132[rule.threat.tactic]
133id = "TA0008"
134name = "Lateral Movement"
135reference = "https://attack.mitre.org/tactics/TA0008/"
136
137[[rule.threat]]
138framework = "MITRE ATT&CK"
139
140[[rule.threat.technique]]
141id = "T1613"
142name = "Container and Resource Discovery"
143reference = "https://attack.mitre.org/techniques/T1613/"
144
145[rule.threat.tactic]
146id = "TA0007"
147name = "Discovery"
148reference = "https://attack.mitre.org/tactics/TA0007/"
149
150[rule.investigation_fields]
151field_names = [
152    "@timestamp",
153    "client.user.email",
154    "source.ip",
155    "user_agent.original",
156    "event.action",
157    "event.outcome",
158    "gcp.audit.resource_name",
159    "data_stream.namespace",
160]