huntrule

GCP Audit: Break-glass Keyword on Kubernetes Pod Create Overrides Binary Authorization

Flags GKE pod creation events where break-glass bypasses Binary Authorization image policy.

FreeReviewedSigma · Medium · v5
Product
gcp
Service
gcp.audit
Author
Bryan Lim (SigmaHQ), DRL 1.1
Published
2024-01-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Kubernetes Pod deployments in GCP audit logs where the pod create action occurs and the event payload includes the break-glass image-policy keyword. Attackers may use break-glass to bypass Binary Authorization enforcement for container images, enabling execution of images that would otherwise be blocked. Detection relies on GCP Audit Log entries for pod creation within Kubernetes clusters and the presence of the break-glass keyword in the recorded payload.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Malicious macOS Credential Verification via dscl authonly
Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)
Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)
Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Linux setcap sets cap_setuid on a binary via setcap utility
GCP Audit: Break-glass Keyword on Kubernetes Pod Create Overrides Binary Authorization
Pivot detection · T1548 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.