Detection of GKE API Request Failure Bursts

This threat brief addresses the detection of malicious reconnaissance and unauthorized access attempts targeting Google Kubernetes Engine (GKE) clusters. Attackers often perform automated enumeration of cloud resources, RBAC permissions, and container configurations by iterating through API calls using compromised or brute-forced credentials. When these attempts result in a high volume of authorization failures within a short period, they create a detectable pattern of behavior. By monitoring for 10 or more failed GKE API requests from a single user identity within a five-minute window, security teams can identify reconnaissance or credential stuffing campaigns. This detection logic is specifically designed for integration with GCP Fleet logs and helps distinguish between legitimate system activity and potential adversary activity early in the kill chain.

Impact

Successful exploitation of this behavior could allow an attacker to gain visibility into the cluster architecture, identify high-value targets, or escalate privileges within the GKE environment. If an attacker successfully probes RBAC policies, they may move from unprivileged reconnaissance to full cluster compromise, leading to data exfiltration, container escape, or long-term persistence within the cloud infrastructure.

Recommendation

Deploy the detection logic to identify unauthorized GKE API activity.

• Enable GCP Fleet integration with GKE audit logging enabled to ensure the required telemetry is available.
• Establish a process for SOC analysts to review event.action and orchestrator.resource.name fields when alerts trigger to distinguish between legitimate misconfigurations and attacker activity.
• Create an allowlist of known service accounts and CI/CD service identity patterns to reduce noise from legitimate but stale automated tasks.
• Investigate the source.ip and user_agent.original fields associated with the alert to determine if the activity originates from known organizational ranges or external/suspicious infrastructure.