LoFP LoFP / new internal tools, sdks, or ci runners introduce novel user agents. baseline expected clients, then exclude stable automation uas after review.

Techniques

Sample rules

GKE Forbidden Request from Unusual User Agent

Description

Detects the first occurrence of a failed GKE API request from a previously unseen user agent. Adversary tooling often uses non-standard clients; combined with authorization failures this can indicate RBAC probing or exploitation attempts.

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
user_agent.original:(* and not (*kubernetes/$Format or kube-probe* or gke-exec-auth-plugin*)) and
not client.user.email:(
  "system:addon-manager" or system\:*controller* or system\:gke-* or
  "system:apiserver" or "system:kube-scheduler" or "system:metrics-server-nanny" or
  "system:kube-proxy" or "system:clustermetrics" or "system:vpa-recommender" or
  "system:cluster-autoscaler" or "system:kubestore-collector" or
  "system:konnectivity-server" or
  "system:serviceaccount:kube-system:pod-garbage-collector" or
  "system:serviceaccount:kube-system:generic-garbage-collector" or system\:node\:* or
  "gcp:kube-bootstrap" or *container-engine-robot*
)