Elastic low stable kql

GKE Secret Access via Unusual User Agent

Detects GKE secrets get or list requests from a previously unseen combination of source IP, identity, and user agent, excluding the default Kubernetes client placeholder. Attackers who compromise a pod or steal a kubeconfig often use curl, custom scripts, or atypical clients from a new host to read service-account tokens, registry credentials, or application secrets. Anonymous identities are excluded; use dedicated anonymous-access rules for unauthenticated probing.

View Source

Detection Logic

data_stream.dataset:gcp.audit and service.name:k8s.io and
event.action:("io.k8s.core.v1.secrets.get" or "io.k8s.core.v1.secrets.list") and
user_agent.original:(* and not (*kubernetes/$Format* or kube-probe* or gke-exec-auth-plugin*)) and
source.ip:(* and not (127.0.0.1 or "::1")) and
client.user.email:(* and not (
  "system:anonymous" or "system:unauthenticated" or "system:addon-manager" or
  "system:serviceaccount:kube-system:namespace-controller"
))

False Positives

⚠ Administrators or CI jobs using a new workstation, bastion, VPN egress, or nonstandard API client can produce a first-seen alert; confirm against change records and expected automation.
⚠ Workloads or operators that change client libraries after a deploy may introduce a new user agent for an otherwise known identity; baseline after validation.

Field Validations

Loading…

Comments (0)

Loading comments...