LoFP / newly deployed operators or workloads that change egress ip will alert once while the history window learns their client fingerprint.

Techniques

• T1552

Sample rules

GKE Unusual Service Account Secret Access via New User Agent

• source: elastic
• technicques:
  • T1552

Description

Detects the first successful GKE secrets.get by a pod service account from a previously unseen combination of service-account identity, user agent, and source IP. Controllers routinely read secrets with a stable client fingerprint; a new user agent or source for that service account could indicate a stolen token used outside the workload (for example curl, a custom script, or kubectl from an unexpected host).

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:success and
event.action:"io.k8s.core.v1.secrets.get" and
client.user.email:system\:serviceaccount\:* and
user_agent.original:(* and not *kubernetes/$Format*) and
source.ip:(* and not (127.0.0.1 or "::1"))