GKE Ephemeral Container Added to Pod

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects allowed updates or patches to the pods/ephemeralcontainers subresource on GKE by a non-system identity.
 11Ephemeral containers are commonly used for debugging (kubectl debug) but can also be abused to inject tooling into a
 12running pod, access mounted secrets, and execute commands in the target pod context. Attackers with sufficient RBAC may
 13use ephemeral containers to escalate privileges, move laterally, or establish persistence without deploying a new
 14workload.
 15"""
 16false_positives = [
 17    """
 18    Cluster operators or SREs may legitimately use ephemeral containers for debugging production workloads. Baseline
 19    approved admin identities and tune exclusions for known automation.
 20    """,
 21]
 22from = "now-6m"
 23index = ["logs-gcp.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "GKE Ephemeral Container Added to Pod"
 27note = """## Triage and analysis
 28
 29### Investigating GKE Ephemeral Container Added to Pod
 30
 31Ephemeral containers allow adding a container to an existing pod for troubleshooting. When abused, they can gain
 32interactive access to a workload, read sensitive files, and run tools that were not present in the original image.
 33
 34### Possible investigation steps
 35
 36- Review `client.user.email`, `source.ip`, and `user_agent.original` and confirm the identity is authorized to use
 37  ephemeral containers.
 38- Inspect `gcp.audit.resource_name` to identify the targeted pod and owning workload.
 39- If request bodies are captured, review the ephemeral container image, command, and securityContext for privilege
 40  indicators.
 41- Correlate with follow-on audit activity such as pod exec, secret reads, TokenRequest, or RBAC modifications.
 42
 43### False positive analysis
 44
 45- Approved on-call debugging with `kubectl debug` may match. Allowlist known admin identities after review.
 46
 47### Response and remediation
 48
 49- If unauthorized, remove excessive RBAC that grants update or patch on pods/ephemeralcontainers and rotate exposed
 50  credentials.
 51- Quarantine or redeploy impacted workloads and hunt for additional compromised pods or identities.
 52
 53"""
 54setup = """
 55The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.
 56"""
 57references = [
 58    "https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/",
 59]
 60risk_score = 47
 61rule_id = "d52e2418-978c-4184-9eab-e084af1f76b7"
 62severity = "medium"
 63tags = [
 64    "Domain: Cloud",
 65    "Domain: Kubernetes",
 66    "Data Source: GCP",
 67    "Data Source: Google Cloud Platform",
 68    "Use Case: Threat Detection",
 69    "Tactic: Privilege Escalation",
 70    "Tactic: Execution",
 71    "Resources: Investigation Guide",
 72]
 73timestamp_override = "event.ingested"
 74type = "query"
 75
 76query = '''
 77data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 78event.action:(
 79  "io.k8s.core.v1.pods.ephemeralcontainers.update" or
 80  "io.k8s.core.v1.pods.ephemeralcontainers.patch"
 81) and not client.user.email:(
 82  system\:node\:* or
 83  system\:serviceaccount\:kube-system\:*
 84)
 85'''
 86
 87[[rule.threat]]
 88framework = "MITRE ATT&CK"
 89
 90[[rule.threat.technique]]
 91id = "T1611"
 92name = "Escape to Host"
 93reference = "https://attack.mitre.org/techniques/T1611/"
 94
 95[rule.threat.tactic]
 96id = "TA0004"
 97name = "Privilege Escalation"
 98reference = "https://attack.mitre.org/tactics/TA0004/"
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102
103[[rule.threat.technique]]
104id = "T1609"
105name = "Container Administration Command"
106reference = "https://attack.mitre.org/techniques/T1609/"
107
108[rule.threat.tactic]
109id = "TA0002"
110name = "Execution"
111reference = "https://attack.mitre.org/tactics/TA0002/"
112
113[rule.investigation_fields]
114field_names = [
115    "@timestamp",
116    "client.user.email",
117    "source.ip",
118    "user_agent.original",
119    "event.action",
120    "event.outcome",
121    "gcp.audit.resource_name",
122    "gcp.audit.request",
123    "data_stream.namespace",
124]