Elastic Security Detection Rules

GKE Forbidden Request from Unusual User Agent

Last updated 6 days ago on 2026-07-16
Created 6 days ago on 2026-07-16

About

Detects the first occurrence of a failed GKE API request from a previously unseen user agent. Adversary tooling often uses non-standard clients; combined with authorization failures this can indicate RBAC probing or exploitation attempts.
Tags
Domain: CloudDomain: KubernetesData Source: GCPData Source: Google Cloud PlatformUse Case: Threat DetectionTactic: ExecutionTactic: DiscoveryLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Execution (TA0002)(external, opens in a new tab or window)

Discovery (TA0007)(external, opens in a new tab or window)

↳ Container and Resource Discovery (T1613)(external, opens in a new tab or window)

False Positive Examples
New internal tools, SDKs, or CI runners introduce novel user agents. Baseline expected clients, then exclude stable automation UAs after review.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-gcp.audit-*
Related Integrations

gcp(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
user_agent.original:(* and not (*kubernetes/$Format or kube-probe* or gke-exec-auth-plugin*)) and
not client.user.email:(
  "system:addon-manager" or system\:*controller* or system\:gke-* or
  "system:apiserver" or "system:kube-scheduler" or "system:metrics-server-nanny" or
  "system:kube-proxy" or "system:clustermetrics" or "system:vpa-recommender" or
  "system:cluster-autoscaler" or "system:kubestore-collector" or
  "system:konnectivity-server" or
  "system:serviceaccount:kube-system:pod-garbage-collector" or
  "system:serviceaccount:kube-system:generic-garbage-collector" or system\:node\:* or
  "gcp:kube-bootstrap" or *container-engine-robot*
)

Install detection rules in Elastic Security

Detect GKE Forbidden Request from Unusual User Agent in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).