GKE Secret Access via Unusual User Agent
ELASTIC detection rule by Elastic · Elastic License v2
Detects GKE secrets get or list requests from a previously unseen combination of source IP, identity, and user agent,
excluding the default Kubernetes client placeholder. Attackers who compromise a pod or steal a kubeconfig often use
curl, custom scripts, or atypical clients from a new host to read service-account tokens, registry credentials, or
application secrets. Anonymous identities are excluded; use dedicated anonymous-access rules for unauthenticated
probing.
[metadata]
creation_date = "2026/07/22"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/22"
[rule]
author = ["Elastic"]
description = """
Detects GKE secrets get or list requests from a previously unseen combination of source IP, identity, and user agent,
excluding the default Kubernetes client placeholder. Attackers who compromise a pod or steal a kubeconfig often use
curl, custom scripts, or atypical clients from a new host to read service-account tokens, registry credentials, or
application secrets. Anonymous identities are excluded; use dedicated anonymous-access rules for unauthenticated
probing.
"""
false_positives = [
"""
Administrators or CI jobs using a new workstation, bastion, VPN egress, or nonstandard API client can produce a
first-seen alert; confirm against change records and expected automation.
""",
"""
Workloads or operators that change client libraries after a deploy may introduce a new user agent for an otherwise
known identity; baseline after validation.
""",
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Secret Access via Unusual User Agent"
note = """## Triage and analysis
### Investigating GKE Secret Access via Unusual User Agent
This new-terms rule alerts on secrets `get`/`list` when the (`source.ip`, `client.user.email`, `user_agent.original`)
triple is new in the history window.
### Possible investigation steps
- Review `client.user.email`, `source.ip`, `user_agent.original`, and `gcp.audit.resource_name` for the secret and
namespace accessed.
- Determine whether the client fingerprint matches an approved admin path, CI runner, or controller upgrade.
- Pivot on the same identity or IP for secret bursts, pod exec, token creation, or RBAC changes.
### False positive analysis
- New admin workstations, VPN egress IPs, or SDK version bumps can first-seen alert; tune after confirming ownership.
- First enablement surfaces legitimate clients until the history window fills.
### Response and remediation
- If malicious, revoke the credential, rotate exposed secrets, isolate the source host or workload, and tighten who
can read secrets.
"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
"https://attack.mitre.org/techniques/T1552/007/",
]
risk_score = 21
rule_id = "854e89c1-f70c-4180-bc53-65999df9d3c3"
severity = "low"
tags = [
"Domain: Cloud",
"Domain: Kubernetes",
"Data Source: GCP",
"Data Source: Google Cloud Platform",
"Use Case: Threat Detection",
"Tactic: Credential Access",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
data_stream.dataset:gcp.audit and service.name:k8s.io and
event.action:("io.k8s.core.v1.secrets.get" or "io.k8s.core.v1.secrets.list") and
user_agent.original:(* and not (*kubernetes/$Format* or kube-probe* or gke-exec-auth-plugin*)) and
source.ip:(* and not (127.0.0.1 or "::1")) and
client.user.email:(* and not (
"system:anonymous" or "system:unauthenticated" or "system:addon-manager" or
"system:serviceaccount:kube-system:namespace-controller"
))
'''
[rule.new_terms]
field = "new_terms_fields"
value = ["source.ip", "client.user.email", "user_agent.original"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.investigation_fields]
field_names = [
"@timestamp",
"client.user.email",
"source.ip",
"user_agent.original",
"event.action",
"event.outcome",
"gcp.audit.resource_name",
"data_stream.namespace",
]