Techniques
Sample rules
GKE Endpoint Permission Enumeration
- source: elastic
- technicques:
- T1613
Description
Detects a single authenticated GKE identity from one source IP issuing a burst of API calls across many distinct actions and resources with a mix of successful and failed outcomes. That pattern is consistent with automated RBAC permission enumeration rather than steady-state controller traffic. Anonymous probing is covered by a separate rule.
Detection logic
from logs-gcp.audit-* metadata _id, _index, _version
| where data_stream.dataset == "gcp.audit"
and service.name == "k8s.io"
and client.user.email is not null
and source.ip is not null
and to_string(source.ip) != "127.0.0.1"
and to_string(source.ip) != "::1"
and client.user.email != "system:anonymous"
and client.user.email != "system:unauthenticated"
and gcp.audit.resource_name != "readyz"
and gcp.audit.resource_name != "livez"
and gcp.audit.resource_name != "healthz"
and gcp.audit.resource_name != "version"
| stats
Esql.document_count = count(),
Esql.event_outcome_count_distinct = count_distinct(event.outcome),
Esql.event_action_count_distinct = count_distinct(event.action),
Esql.gcp_audit_resource_name_count_distinct = count_distinct(gcp.audit.resource_name),
Esql.earliest_timestamp = min(@timestamp),
Esql.latest_timestamp = max(@timestamp),
Esql.event_action_values = values(event.action),
Esql.event_outcome_values = values(event.outcome),
Esql.gcp_audit_resource_name_values = values(gcp.audit.resource_name),
Esql.user_agent_original_values = values(user_agent.original)
by client.user.email, source.ip
| where Esql.event_outcome_count_distinct == 2
and Esql.event_action_count_distinct > 5
and Esql.gcp_audit_resource_name_count_distinct > 3
and Esql.document_count < 75
| keep Esql.*, client.user.email, source.ip