Elastic Security Detection Rules

GKE Anonymous Pod Create/Update/Patch

Last updated 6 days ago on 2026-07-16
Created 6 days ago on 2026-07-16

About

Detects create, update, or patch of pods by an unauthenticated anonymous GKE identity. Anonymous pod mutation is a critical misconfiguration signal and a common path for unauthenticated attackers to deploy workloads or maintain access. Includes "system:anonymous" / "system:unauthenticated" and GKE audit rows with a missing principal (seen on unauthenticated Unauthorized/forbidden pod writes).
Tags
Domain: CloudDomain: KubernetesData Source: GCPData Source: Google Cloud PlatformUse Case: Threat DetectionTactic: ExecutionLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Execution (TA0002)(external, opens in a new tab or window)

↳ Deploy Container (T1610)(external, opens in a new tab or window)

False Positive Examples
Anonymous pod writes should be rare. If observed from expected automation, anonymous authentication or RBAC for system:anonymous is likely misconfigured and should be remediated rather than broadly excluded.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-gcp.audit-*
Related Integrations

gcp(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:gcp.audit and service.name:k8s.io and client.user.email:("system:anonymous" or "system:unauthenticated" or not *) and event.action:(io.k8s.core.v1.pods.create or io.k8s.core.v1.pods.patch or io.k8s.core.v1.pods.update)

Install detection rules in Elastic Security

Detect GKE Anonymous Pod Create/Update/Patch in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).