Detection rules › Splunk

GCP Kubernetes cluster pod scan detection

Status
experimental
Author
Rod Soto, Splunk
Source
github.com/splunk/security_content

The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1526 Cloud Service Discovery

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body splunk

name: GCP Kubernetes cluster pod scan detection
id: 19b53215-4a16-405b-8087-9e6acf619842
version: 8
creation_date: '2020-07-17'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: experimental
type: Hunting
description: The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.
data_source: []
search: |-
    `google_gcp_pubsub_message` category=kube-audit
      | spath input=properties.log
      | search responseStatus.code=401
      | table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod
      | `gcp_kubernetes_cluster_pod_scan_detection_filter`
how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
known_false_positives: Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods  will provide context.
references: []
analytic_story:
    - Kubernetes Scanning Activity
    - Scattered Lapsus$ Hunters
asset_type: GCP Kubernetes cluster
mitre_attack_id:
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

Stages and Predicates

Stage 1: search

`google_gcp_pubsub_message` category=kube-audit

Stage 2: spath

| spath input=properties.log

Stage 3: search

| search responseStatus.code=401

Stage 4: table

| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod

Stage 5: search

| `gcp_kubernetes_cluster_pod_scan_detection_filter`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
categoryeq
  • kube-audit
responseStatus.codeeq
  • 401
sourcetypeeq
  • google:gcp:pubsub:message