GCP Audit Log: Break-glass Flag Kubernetes Pod Created in GKE Cluster

title: "GCP Audit Log: Break-glass Flag Kubernetes Pod Created in GKE Cluster"
id: b2d25c3b-db6f-4b32-9486-31edd79f2391
status: test
description: This rule identifies Kubernetes pod creation events in GKE audit logs where the pod spec includes the break-glass flag that bypasses Binary Authorization image policy enforcement. Attackers may use break-glass to deploy workloads that would otherwise be blocked, making it a privilege and policy-evasion indicator. Detection relies on GCP audit log entries for pod creation and the presence of the specific break-glass keyword in the audited payload.
references:
  - https://cloud.google.com/binary-authorization
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml
author: Bryan Lim, Huntrule Team
date: 2024-01-12
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    data.protoPayload.resource.type: k8s_cluster
    data.protoPayload.logName:
      - cloudaudit.googleapis.com/activity
      - cloudaudit.googleapis.com%2Factivity
    data.protoPayload.methodName: io.k8s.core.v1.pods.create
  keywords:
    - image-policy.k8s.io/break-glass
  condition: selection and keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 76737c19-66ee-4c07-b65a-a03301d1573d
    type: derived