GKE Suspicious Assignment of Controller Service Account

  1[metadata]
  2creation_date = "2026/07/10"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a request to attach a built-in kube-controller-manager service account to a pod running in the kube-system
 11namespace on GKE. These service accounts are admin-equivalent and are not normally assigned to arbitrary pods. An attacker
 12who can create pods in kube-system can abuse these tokens for cluster-wide privilege escalation.
 13"""
 14false_positives = [
 15    """
 16    Built-in controller service accounts are rarely assigned to running pods. False positives should be rare; allowlist
 17    documented platform automation by actor when baselined.
 18    """,
 19]
 20from = "now-6m"
 21index = ["logs-gcp.audit-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "GKE Suspicious Assignment of Controller Service Account"
 25note = """## Triage and analysis
 26
 27### Investigating GKE Suspicious Assignment of Controller Service Account
 28
 29This rule flags pod create events in kube-system that assign a built-in kube-controller-manager service account.
 30
 31### Possible investigation steps
 32
 33- Review `client.user.email`, `gcp.audit.request.spec.serviceAccountName`, and container images.
 34- Determine whether the pod aligns with expected platform operations.
 35- Assess permissions of the assigned service account and hunt for follow-on secret or RBAC activity.
 36
 37### False positive analysis
 38
 39- Built-in controller service accounts should not be mounted on user-created pods. Allowlist known automation by actor if a documented exception exists.
 40
 41### Response and remediation
 42
 43- Delete suspicious pods, revoke the service account token, and restrict pod create permissions in kube-system.
 44
 45"""
 46setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 47references = [
 48    "https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms",
 49    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/#controller-roles",
 50]
 51risk_score = 47
 52rule_id = "e2f60d42-e0ea-4a03-a151-942bb5b86c0b"
 53severity = "medium"
 54tags = [
 55    "Domain: Cloud",
 56    "Domain: Kubernetes",
 57    "Data Source: GCP",
 58    "Data Source: Google Cloud Platform",
 59    "Use Case: Threat Detection",
 60    "Tactic: Execution",
 61    "Tactic: Privilege Escalation",
 62    "Resources: Investigation Guide",
 63    "Noise: Unknown",
 64    "Performance: Fast",
 65    "Rule Type: Custom Query (KQL)",
 66    "Platform: GCP",
 67    "Domain: Containers",
 68    "Platform: Kubernetes",
 69]
 70timestamp_override = "event.ingested"
 71type = "query"
 72
 73query = '''
 74data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 75event.action:"io.k8s.core.v1.pods.create" and gcp.audit.request.metadata.namespace:"kube-system" and
 76gcp.audit.request.spec.serviceAccountName:(
 77  attachdetach-controller or certificate-controller or cloud-provider or
 78  clusterrole-aggregation-controller or cronjob-controller or daemon-set-controller or deployment-controller or
 79  disruption-controller or endpoint-controller or expand-controller or generic-garbage-collector or
 80  horizontal-pod-autoscaler or job-controller or namespace-controller or node-controller or
 81  persistent-volume-binder or pod-garbage-collector or pv-protection-controller or pvc-protection-controller or
 82  replicaset-controller or replication-controller or resourcequota-controller or root-ca-cert-publisher or
 83  route-controller or service-account-controller or service-controller or statefulset-controller or ttl-controller
 84)
 85'''
 86
 87[[rule.threat]]
 88framework = "MITRE ATT&CK"
 89
 90[[rule.threat.technique]]
 91id = "T1078"
 92name = "Valid Accounts"
 93reference = "https://attack.mitre.org/techniques/T1078/"
 94
 95[[rule.threat.technique.subtechnique]]
 96id = "T1078.001"
 97name = "Default Accounts"
 98reference = "https://attack.mitre.org/techniques/T1078/001/"
 99
100[rule.threat.tactic]
101id = "TA0004"
102name = "Privilege Escalation"
103reference = "https://attack.mitre.org/tactics/TA0004/"
104
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107
108[[rule.threat.technique]]
109id = "T1610"
110name = "Deploy Container"
111reference = "https://attack.mitre.org/techniques/T1610/"
112
113[rule.threat.tactic]
114id = "TA0002"
115name = "Execution"
116reference = "https://attack.mitre.org/tactics/TA0002/"
117
118[rule.investigation_fields]
119field_names = [
120    "@timestamp",
121    "client.user.email",
122    "source.ip",
123    "user_agent.original",
124    "event.action",
125    "event.outcome",
126    "gcp.audit.resource_name",
127    "gcp.audit.request.spec.serviceAccountName",
128    "gcp.audit.request.spec.containers.image",
129    "data_stream.namespace",
130]