GCP Break-glass Container Workload Deployed

Status: test
Severity: medium
Log source: product gcp, service gcp.audit
Author: Bryan Lim
Source: github.com/SigmaHQ/sigma

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism

Telemetry coverage

Platform	Record / event type
Kubernetes	create-pods: create pods

Rules detecting the same action

These rules filter on the same operation.

Attach/Exec Pod (Falco)
Azure AKS Attempted User Exec into Pod (Elastic)
Container With A hostPath Mount Created (Sigma)
Create Disallowed Pod (Falco)
Create HostIPC Pod (Falco)
Create HostNetwork Pod (Falco)
Create HostPid Pod (Falco)
Create Privileged Pod (Falco)

Rule body

title: GCP Break-glass Container Workload Deployed
id: 76737c19-66ee-4c07-b65a-a03301d1573d
status: test
description: |
    Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.
references:
    - https://cloud.google.com/binary-authorization
author: Bryan Lim
date: 2024-01-12
tags:
    - attack.privilege-escalation
    - attack.t1548
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        data.protoPayload.resource.type: 'k8s_cluster'
        data.protoPayload.logName:
            - 'cloudaudit.googleapis.com/activity'
            - 'cloudaudit.googleapis.com%2Factivity'
        data.protoPayload.methodName: 'io.k8s.core.v1.pods.create'
    keywords:
        - 'image-policy.k8s.io/break-glass'
    condition: selection and keywords
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and keywords

Stage 1: `selection`

selection:
    data.protoPayload.resource.type: 'k8s_cluster'
    data.protoPayload.logName:
        - 'cloudaudit.googleapis.com/activity'
        - 'cloudaudit.googleapis.com%2Factivity'
    data.protoPayload.methodName: 'io.k8s.core.v1.pods.create'

Stage 2: `keywords`

keywords:
    - 'image-policy.k8s.io/break-glass'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`data.protoPayload.logName`	eq	`cloudaudit.googleapis.com%2Factivity` `cloudaudit.googleapis.com/activity`	`field:"gcp::log_name" kind:eq`
`data.protoPayload.methodName`	eq	`io.k8s.core.v1.pods.create`	`field:"data.protoPayload.methodName" kind:eq value:"io.k8s.core.v1.pods.create"`
`data.protoPayload.resource.type`	eq	`k8s_cluster`	`field:"gcp::resource_type" kind:eq value:"k8s_cluster"`