[New Rule] GCP Kubernetes Sensitive Object Access

[austinsonger]

Description

Identifies kubernetes accounts accessing sensitve objects such as configmaps or secrets.

Required Info

Target indexes

filebeat-*, logs-gcp*

Platforms

Google Cloud

Optional Info

Query

event.dataset:(googlecloud.audit or gcp.audit) and
event.provider:cloudaudit.googleapis.com and
gcp.audit.authorization_info :
	(
	"configmaps " or 
	"secrets"
	) and
event.outcome:success

New fields required in ECS/data sources for this rule?

Related issues or PRs

False Positives

MITRE

Tactic	Technique ID	Technique Name	Sub-Technique Name

References

• https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging