emergency kubectl changes, vpn or workstation migrations, and ci runner rotation can produce new user agent, source ip, and username combinations for authorized operators. baseline expected automation before tuning.

t1098
gcp
elastic

Techniques

T1098

Sample rules

GKE Unusual Sensitive Workload Modification

source: elastic
technicques:
- T1098

Description

Detects the first occurrence of create or patch activity against sensitive GKE workloads (DaemonSets, Deployments, or CronJobs) from an unusual combination of user agent, source IP, and user identity, which may indicate privilege escalation or unauthorized access within the cluster.

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:success and user_agent.original:* and client.user.email:(* and not system\:*) and source.ip:* and event.action:(io.k8s.apps.v1.daemonsets.create or io.k8s.apps.v1.daemonsets.patch or io.k8s.apps.v1.deployments.create or io.k8s.apps.v1.deployments.patch or io.k8s.batch.v1.cronjobs.create or io.k8s.batch.v1.cronjobs.patch)