Detectionmediumtest

GCP Break-glass Container Workload Deployed

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Bryan LimCreated Fri Jan 1276737c19-66ee-4c07-b65a-a03301d1573dcloud

Log Source

Google Cloudgcp.audit

ProductGoogle Cloud← raw: gcp

Servicegcp.audit← raw: gcp.audit

Detection Logic

detection:
    selection:
        data.protoPayload.resource.type: 'k8s_cluster'
        data.protoPayload.logName:
            - 'cloudaudit.googleapis.com/activity'
            - 'cloudaudit.googleapis.com%2Factivity'
        data.protoPayload.methodName: 'io.k8s.core.v1.pods.create'
    keywords:
        - 'image-policy.k8s.io/break-glass'
    condition: selection and keywords