anonymous pod writes should be rare. if observed from expected automation, anonymous authentication or rbac for system:anonymous is likely misconfigured and should be remediated rather than broadly excluded.

T1610
gcp
elastic

Techniques

T1610

Sample rules

GKE Anonymous Pod Create/Update/Patch

source: elastic
technicques:
- T1610

Description

Detects create, update, or patch of pods by an unauthenticated anonymous GKE identity. Anonymous pod mutation is a critical misconfiguration signal and a common path for unauthenticated attackers to deploy workloads or maintain access. Includes “system:anonymous” / “system:unauthenticated” and GKE audit rows with a missing principal (seen on unauthenticated Unauthorized/forbidden pod writes).

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and client.user.email:("system:anonymous" or "system:unauthenticated" or not *) and event.action:(io.k8s.core.v1.pods.create or io.k8s.core.v1.pods.patch or io.k8s.core.v1.pods.update)