Google Kubernetes Engine accounts accessing sensitive objects
Sensitive object access is not necessarily malicious, but user and object context can provide guidance for detection. You want to investigate sensitive object access on your network to determine if it represents a threat.
Required data
- Google Kubernetes Engine
- Google Pub/Sub data
Procedure
Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype="google:gcp:pubsub:message" data.protoPayload.authorizationInfo{}.resource=configmaps OR secrets
| table data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name data.protoPayload.request.metadata.namespace data.labels.authorization.k8s.io/decision
| dedup data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
| Splunk Search | Explanation |
|---|---|
|
sourcetype="google:gcp:pubsub:message" |
Search only GCP Pub/Sub messages. |
|
data.protoPayload.authorizationInfo{}.resource=configmaps OR secrets |
Search specific, sensitive resources such as secrets or configmaps. |
|
| table data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name data.protoPayload.request.metadata.namespace data.labels.authorization.k8s.io/decision |
Display the results in a table with columns in the order shown. |
|
| dedup data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name |
Remove duplicate results from the same caller IP address, user, and cluster name. |
Next steps
Compromise of sensitive objects can lead to cluster compromise and further lateral movement. Secrets and configmaps are highly sensitive objects due the cluster information they contain. Multiple failed or denied attempts may indicate suspicious activity. Source IP address, users, geolocation, and reputation are other useful contextual items to evaluate to look for compromise. To refine the search, adding data.labels.authorization.k8s.io/decision!=allow may give fewer results and more specific context on errors or suspicious requests.
For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub for AWS, Azure, or GCP.
Finally, you might be interested in other processes associated with the Monitoring Kubernetes sensitive object access use case.