GKE Certificate Signing Request API Client Signer Requested

Detects creation of a GKE CertificateSigningRequest (CSR) that requests the kubernetes.io/kube-apiserver-client signer. This signer issues general API client certificates with few subject restrictions, unlike the restricted kubelet signers used for node certificate rotation. Attackers with CSR permissions use this signer to mint long-lived credentials for privileged identities such as system:kube-controller-manager, enabling persistence and privilege escalation that survives token revocation and RBAC changes.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2026/07/10"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2026/07/10"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects creation of a GKE CertificateSigningRequest (CSR) that requests the kubernetes.io/kube-apiserver-client signer.
11This signer issues general API client certificates with few subject restrictions, unlike the restricted kubelet signers
12used for node certificate rotation. Attackers with CSR permissions use this signer to mint long-lived credentials for
13privileged identities such as system:kube-controller-manager, enabling persistence and privilege escalation that survives
14token revocation and RBAC changes.
15"""
16false_positives = [
17    """
18    Custom PKI or administrative tooling may legitimately request kubernetes.io/kube-apiserver-client certificates in
19    self-managed clusters. Baseline approved operators and tune exclusions for known automation on GKE.
20    """,
21]
22from = "now-6m"
23index = ["logs-gcp.audit-*"]
24language = "kuery"
25license = "Elastic License v2"
26name = "GKE Certificate Signing Request API Client Signer Requested"
27note = """## Triage and analysis
28
29### Investigating GKE Certificate Signing Request API Client Signer Requested
30
31Identify the actor (`client.user.email`), `source.ip`, and `user_agent.original`. Legitimate GKE node certificate
32rotation uses `kubernetes.io/kube-apiserver-client-kubelet` or `kubernetes.io/kubelet-serving` — not this signer.
33Review `gcp.audit.request.spec.signerName` and decode `gcp.audit.request.spec.request` when present to extract the
34requested Common Name (CN).
35
36```bash
37# Full decoded PEM block
38echo "<gcp.audit.request.spec.request>" | base64 -d
39
40# Parsed CSR details (subject, key type/size, extensions, signature)
41echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -text
42
43# Subject only
44echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -subject

Possible investigation steps

• Confirm whether the principal is authorized to request API client certificates and whether the activity aligns with approved PKI workflows.
• Decode gcp.audit.request.spec.request and inspect the CSR subject for privileged identities such as system:masters, system:kube-controller-manager, or system:admin.
• Correlate with CSR approval or patch activity on the same gcp.audit.resource_name and follow-on API access from unusual networks.
• Review RBAC grants on certificatesigningrequests create and certificatesigningrequests/approval for the actor.

False positive analysis

• Custom PKI or admin workflows may legitimately use this signer outside kube-system. Baseline and tune for known operators.

Related rules

• GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
• GKE Certificate Signing Request Self-Approved - e155e658-3dcd-4d27-a4e5-1d8da6704b0e
• GKE Client Certificate Signing Request Created or Approved - ec67ab57-945a-4edb-84f8-1d7a51f46544

Response and remediation

• Deny or delete suspicious CSRs, rotate cluster signing trust if abused, and remove excessive CSR RBAC from untrusted identities.

""" setup = "The GCP Fleet integration with GKE audit logs enabled is required. Request body capture for CSR create events (gcp.audit.request.spec.signerName) typically requires RequestResponse audit level on CertificateSigningRequest resources." references = [ "https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/", "https://kubernetes.io/docs/concepts/security/rbac-good-practices/", "https://www.aquasec.com/blog/kubernetes-rbac-privilige-escalation/", "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.persistence.create-client-certificate/", ] risk_score = 73 rule_id = "1e344fba-a2f7-462b-aaec-d6c8f80d5a28" severity = "high" tags = [ "Domain: Cloud", "Domain: Kubernetes", "Data Source: GCP", "Data Source: GCP Audit Logs", "Data Source: Google Cloud Platform", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Resources: Investigation Guide", ] timestamp_override = "event.ingested" type = "query"

query = ''' data_stream.dataset:"gcp.audit" and service.name:"k8s.io" and event.outcome:"success" and event.action:"io.k8s.certificates.v1.certificatesigningrequests.create" and gcp.audit.request.spec.signerName:"kubernetes.io/kube-apiserver-client" and not client.user.email:( "system:gcp-controller-manager" or "system:serviceaccount:kube-system:certificate-controller" ) '''

[[rule.threat]] framework = "MITRE ATT&CK"

[[rule.threat.technique]] id = "T1098" name = "Account Manipulation" reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]] id = "T1098.006" name = "Additional Container Cluster Roles" reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic] id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]] framework = "MITRE ATT&CK"

[[rule.threat.technique]] id = "T1098" name = "Account Manipulation" reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]] id = "T1098.006" name = "Additional Container Cluster Roles" reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic] id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields] field_names = [ "@timestamp", "client.user.email", "source.ip", "user_agent.original", "event.action", "event.outcome", "gcp.audit.resource_name", "gcp.audit.request.spec.signerName", "gcp.audit.request.spec.request", "data_stream.namespace", ]

Triage and analysis

Investigating GKE Certificate Signing Request API Client Signer Requested

Identify the actor (client.user.email), source.ip, and user_agent.original. Legitimate GKE node certificate rotation uses kubernetes.io/kube-apiserver-client-kubelet or kubernetes.io/kubelet-serving — not this signer. Review gcp.audit.request.spec.signerName and decode gcp.audit.request.spec.request when present to extract the requested Common Name (CN).

1# Full decoded PEM block
2echo "<gcp.audit.request.spec.request>" | base64 -d
3
4# Parsed CSR details (subject, key type/size, extensions, signature)
5echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -text
6
7# Subject only
8echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -subject

Possible investigation steps

• Confirm whether the principal is authorized to request API client certificates and whether the activity aligns with approved PKI workflows.
• Decode gcp.audit.request.spec.request and inspect the CSR subject for privileged identities such as system:masters, system:kube-controller-manager, or system:admin.
• Correlate with CSR approval or patch activity on the same gcp.audit.resource_name and follow-on API access from unusual networks.
• Review RBAC grants on certificatesigningrequests create and certificatesigningrequests/approval for the actor.

False positive analysis

• Custom PKI or admin workflows may legitimately use this signer outside kube-system. Baseline and tune for known operators.

Related rules

• GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
• GKE Certificate Signing Request Self-Approved - e155e658-3dcd-4d27-a4e5-1d8da6704b0e
• GKE Client Certificate Signing Request Created or Approved - ec67ab57-945a-4edb-84f8-1d7a51f46544

Response and remediation

• Deny or delete suspicious CSRs, rotate cluster signing trust if abused, and remove excessive CSR RBAC from untrusted identities.