GKE Exposed Service Created With Type NodePort

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Exposed Service Created With Type NodePort

edit

Detects creation or modification of a GKE Service with type NodePort. NodePort exposes a static port on every worker node that hosts matching pods, which widens the cluster’s external attack surface and can bypass load-balancer and firewall controls. Attackers may create NodePort Services to intercept traffic or establish a direct path into the cluster.

Rule type: query

Rule indices:

logs-gcp.audit-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Kubernetes
Data Source: GCP
Data Source: Google Cloud Platform
Use Case: Threat Detection
Tactic: Persistence
Tactic: Initial Access
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Exposed Service Created With Type NodePort

NodePort opens a port on each worker node hosting the service and forwards external traffic to labeled pods. Confirm whether the exposure was approved and which workloads are reachable.

Possible investigation steps

Review client.user.email, source.ip, and user_agent.original.
Inspect gcp.audit.resource_name and gcp.audit.request for the service name, namespace, selector, and port.
Identify the backing pods and whether the NodePort is required for a legitimate external entrypoint.
Correlate with recent Service or networking changes from the same actor.

False positive analysis

Approved NodePort Services for lab frontends or custom load balancing may match. Allowlist known automation or namespaces after review.
GKE addon reconciliation via system:addon-manager patch is excluded; unexpected create or update from that actor should still be investigated.

Response and remediation

Remove or change unauthorized NodePort Services, revoke excess RBAC for Services writes, and review firewall exposure for the opened node ports.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required. Request body capture for Service resources is required so gcp.audit.request.spec.type is populated.

Rule query

edit

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.core.v1.services.create" or
  "io.k8s.core.v1.services.update" or
  "io.k8s.core.v1.services.patch"
) and gcp.audit.request.spec.type:"NodePort" and not (
  client.user.email:"system:addon-manager" and
  event.action:"io.k8s.core.v1.services.patch"
)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: External Remote Services
- ID: T1133
- Reference URL: https://attack.mitre.org/techniques/T1133/
Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
Technique:
- Name: External Remote Services
- ID: T1133
- Reference URL: https://attack.mitre.org/techniques/T1133/

« GKE Client Certificate Signing Request Created or Approved GKE Creation of a RoleBinding Referencing a ServiceAccount »