LoFP / administrators or ci jobs using a new workstation, bastion, vpn egress, or nonstandard api client can produce a first-seen alert; confirm against change records and expected automation.

Techniques

• T1552

Sample rules

GKE Secret Access via Unusual User Agent

• source: elastic
• technicques:
  • T1552

Description

Detects GKE secrets get or list requests from a previously unseen combination of source IP, identity, and user agent, excluding the default Kubernetes client placeholder. Attackers who compromise a pod or steal a kubeconfig often use curl, custom scripts, or atypical clients from a new host to read service-account tokens, registry credentials, or application secrets. Anonymous identities are excluded; use dedicated anonymous-access rules for unauthenticated probing.

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and
event.action:("io.k8s.core.v1.secrets.get" or "io.k8s.core.v1.secrets.list") and
user_agent.original:(* and not (*kubernetes/$Format* or kube-probe* or gke-exec-auth-plugin*)) and
source.ip:(* and not (127.0.0.1 or "::1")) and
client.user.email:(* and not (
  "system:anonymous" or "system:unauthenticated" or "system:addon-manager" or
  "system:serviceaccount:kube-system:namespace-controller"
))