GKE Forbidden Request from Unusual User Agent

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Forbidden Request from Unusual User Agent

Detects the first occurrence of a failed GKE API request from a previously unseen user agent. Adversary tooling often uses non-standard clients; combined with authorization failures this can indicate RBAC probing or exploitation attempts.

Rule type: new_terms

Rule indices:

logs-gcp.audit-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Kubernetes
Data Source: GCP
Data Source: Google Cloud Platform
Use Case: Threat Detection
Tactic: Execution
Tactic: Discovery
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Forbidden Request from Unusual User Agent

A novel user agent with failed API calls may be scanner or post-compromise tooling probing RBAC.

Investigation steps

Review user_agent.original, client.user.email, event.action, gcp.audit.resource_name, and source.ip.
Determine whether the client is expected (new SDK, CI image) or external reconnaissance.
Hunt for successful requests from the same UA or source after the failures.

False positives

First use of a legitimate new client library; add a scoped UA exception after validation.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Rule query

edit

data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
user_agent.original:(* and not (*kubernetes/$Format or kube-probe* or gke-exec-auth-plugin*)) and
not client.user.email:(
  "system:addon-manager" or system\:*controller* or system\:gke-* or
  "system:apiserver" or "system:kube-scheduler" or "system:metrics-server-nanny" or
  "system:kube-proxy" or "system:clustermetrics" or "system:vpa-recommender" or
  "system:cluster-autoscaler" or "system:kubestore-collector" or
  "system:konnectivity-server" or
  "system:serviceaccount:kube-system:pod-garbage-collector" or
  "system:serviceaccount:kube-system:generic-garbage-collector" or system\:node\:* or
  "gcp:kube-bootstrap" or *container-engine-robot*
)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Tactic:
- Name: Discovery
- ID: TA0007
- Reference URL: https://attack.mitre.org/tactics/TA0007/
Technique:
- Name: Container and Resource Discovery
- ID: T1613
- Reference URL: https://attack.mitre.org/techniques/T1613/

« GKE Forbidden Creation Request GKE Pod Created With HostIPC »