GKE API Request Impersonating Privileged Identity

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects GKE API requests where a caller is impersonating a privileged cluster identity such as
 11system:kube-controller-manager, system:admin, system:anonymous, or a kube-system service account. These identities have
 12broad cluster-wide permissions including unrestricted access to secrets, the ability to create tokens for any service
 13account, schedule pods on any node, and modify RBAC. Impersonating system:kube-controller-manager grants access to
 14secrets across namespaces and service account token minting for lateral movement.
 15"""
 16false_positives = [
 17    """
 18    Break-glass admin tooling, security scanners, or approved controllers that legitimately use impersonation against
 19    privileged targets may match. Map expected callers and expand client.user.email exclusions as needed.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE API Request Impersonating Privileged Identity"
 27note = """## Triage and analysis
 28
 29### Investigating GKE API Request Impersonating Privileged Identity
 30
 31Compare the real actor (`client.user.email`, `source.ip`, `user_agent.original`) with the impersonated identity in
 32`gcp.audit.authentication_info.authority_selector` (Cloud Audit `authenticationInfo.authoritySelector`). Confirm
 33whether impersonation is authorized for that principal and target identity.
 34
 35### Possible investigation steps
 36
 37- Review `event.action` and `gcp.audit.resource_name` for the scope of the operation performed while impersonating.
 38- Determine whether the real user or service account should have `impersonate` rights against the target user or group;
 39  inspect RBAC bindings and any recent changes.
 40- Correlate with adjacent audit activity (secrets, TokenRequest, RBAC writes, CSR approval) from the same source
 41  identity.
 42- Hunt for repeated impersonation across namespaces or rapid pivoting after the event.
 43
 44### False positive analysis
 45
 46- Approved admin or scanner workflows that intentionally use `kubectl --as` against privileged targets may match.
 47  Allowlist those identities after review.
 48
 49### Response and remediation
 50
 51- Revoke or tighten `impersonate` permissions for unexpected identities; rotate credentials for any account that may
 52  have abused impersonation.
 53- If unauthorized, treat as cluster-wide credential risk: review secrets exposure, issued tokens, and RBAC drift.
 54
 55"""
 56setup = """
 57The GCP Fleet integration with GKE audit logs enabled is required. Kubernetes impersonation (`kubectl --as`) maps to
 58`gcp.audit.authentication_info.authority_selector` in Fleet.
 59"""
 60references = [
 61    "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation",
 62    "https://kubernetes.io/docs/reference/access-authn-authz/user-impersonation/",
 63]
 64risk_score = 73
 65rule_id = "00c2a946-bbe8-4345-941d-9ea13da91600"
 66severity = "high"
 67tags = [
 68    "Domain: Cloud",
 69    "Domain: Kubernetes",
 70    "Data Source: GCP",
 71    "Data Source: Google Cloud Platform",
 72    "Use Case: Threat Detection",
 73    "Tactic: Privilege Escalation",
 74    "Tactic: Defense Evasion",
 75    "Resources: Investigation Guide",
 76    "Noise: Unknown",
 77    "Performance: Fast",
 78    "Rule Type: Custom Query (KQL)",
 79    "Platform: GCP",
 80    "Domain: Containers",
 81    "Platform: Kubernetes",
 82]
 83timestamp_override = "event.ingested"
 84type = "query"
 85
 86query = '''
 87data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 88gcp.audit.authentication_info.authority_selector:(
 89  "admin" or "cluster-admin" or "kubernetes-admin" or "system:admin" or "system:anonymous" or
 90  "system:apiserver" or "system:kube-controller-manager" or "system:kube-proxy" or
 91  "system:kube-scheduler" or "system:volume-scheduler" or
 92  system\:node\:* or system\:serviceaccount\:kube-system\:*
 93) and
 94not client.user.email:(
 95  "system:kube-controller-manager" or
 96  "system:kube-scheduler" or
 97  system\:node\:* or
 98  system\:serviceaccount\:kube-system\:*
 99)
100'''
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104
105[[rule.threat.technique]]
106id = "T1134"
107name = "Access Token Manipulation"
108reference = "https://attack.mitre.org/techniques/T1134/"
109
110[rule.threat.tactic]
111id = "TA0004"
112name = "Privilege Escalation"
113reference = "https://attack.mitre.org/tactics/TA0004/"
114
115[[rule.threat]]
116framework = "MITRE ATT&CK"
117
118[[rule.threat.technique]]
119id = "T1134"
120name = "Access Token Manipulation"
121reference = "https://attack.mitre.org/techniques/T1134/"
122
123[rule.threat.tactic]
124id = "TA0005"
125name = "Defense Evasion"
126reference = "https://attack.mitre.org/tactics/TA0005/"
127
128[rule.investigation_fields]
129field_names = [
130    "@timestamp",
131    "client.user.email",
132    "source.ip",
133    "user_agent.original",
134    "event.action",
135    "event.outcome",
136    "gcp.audit.authentication_info.authority_selector",
137    "gcp.audit.resource_name",
138    "data_stream.namespace",
139]