Sunturai
Back to results
MediumElastic detection rulesElastic

GKE Endpoint Permission Enumeration

Detects a single authenticated GKE identity from one source IP issuing a burst of API calls across many distinct actions and resources with a mix of successful and failed outcomes. That pattern is consistent with…

Description

Detects a single authenticated GKE identity from one source IP issuing a burst of API calls across many distinct actions and resources with a mix of successful and failed outcomes. That pattern is consistent with automated RBAC permission enumeration rather than steady-state controller traffic. Anonymous probing is covered by a separate rule.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
Containers

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • Administrators troubleshooting RBAC from a workstation or VPN may generate mixed allow/deny results across many APIs in a short window; tune by identity or source IP after validation.
  • Newly deployed workloads with incomplete RoleBindings can probe several APIs during startup and encounter intermittent denials; exclude known service accounts if documented.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice