LoFP LoFP / approved scripts, ci jobs, or penetration tests may use generic http clients. validate tickets and identity scope before treating as compromise.

Techniques

Sample rules

GKE Secret get or list with Suspicious User Agent

Description

Detects successful GKE secret get or list operations where the user agent matches scripting runtimes, minimal HTTP clients, or offensive-distribution fingerprints rather than typical kubectl or controller traffic.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:("io.k8s.core.v1.secrets.list" or "io.k8s.core.v1.secrets.get") and user_agent.original:(
  curl* or python* or Python* or wget* or Go-http* or perl* or java* or node* or php* or *distrib#kali* or *kali-amd64* or
  *kali-arm64* or Bun* or axios* or undici*
)