GKE Anonymous Pod Create/Update/Patch

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Anonymous Pod Create/Update/Patch

Detects create, update, or patch of pods by an unauthenticated anonymous GKE identity. Anonymous pod mutation is a critical misconfiguration signal and a common path for unauthenticated attackers to deploy workloads or maintain access. Includes "system:anonymous" / "system:unauthenticated" and GKE audit rows with a missing principal (seen on unauthenticated Unauthorized/forbidden pod writes).

Rule type: query

Rule indices:

logs-gcp.audit-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Kubernetes
Data Source: GCP
Data Source: Google Cloud Platform
Use Case: Threat Detection
Tactic: Execution
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Anonymous Pod Create/Update/Patch

Anonymous identities creating or mutating pods indicates the API server accepts unauthenticated workload changes. Failed unauthenticated creates may appear with an empty client.user.email and Unauthorized / forbidden status.

Investigation steps

Review client.user.email, event.action, event.outcome, orchestrator.resource.name, orchestrator.namespace, and source.ip.
Inspect the pod image, command, and volume mounts for credential theft or reverse shells.
Check whether anonymous authentication is enabled and remove RBAC grants to system:anonymous.

False positives

Essentially none in production; treat as high-priority misconfiguration until proven otherwise.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Rule query

edit

data_stream.dataset:gcp.audit and service.name:k8s.io and client.user.email:("system:anonymous" or "system:unauthenticated" or not *) and event.action:(io.k8s.core.v1.pods.create or io.k8s.core.v1.pods.patch or io.k8s.core.v1.pods.update)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Deploy Container
- ID: T1610
- Reference URL: https://attack.mitre.org/techniques/T1610/

« GKE Anonymous Endpoint Permission Enumeration GKE Forbidden Creation Request »