---
title: GKE Anonymous Endpoint Permission Enumeration
description: Detects bursts of GKE API requests from an anonymous identity that probe many distinct actions and resources with mostly failed outcomes. This pattern...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_anonymous_endpoint_permission_enumeration
products:
  - Elastic Security
---

# GKE Anonymous Endpoint Permission Enumeration
Detects bursts of GKE API requests from an anonymous identity that probe many distinct actions and resources with
mostly failed outcomes. This pattern is consistent with unauthenticated permission enumeration against an exposed API
server. On GKE GCP audit logs, unauthenticated probes often omit "client.user.email" (null principal) with
Unauthorized failures; those events are included alongside "system:anonymous" / "system:unauthenticated".
**Rule type**: esql
**Rule indices**:
**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 5m
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://heilancoos.github.io/research/2025/12/16/kubernetes.html#unauthenticated-api-access](https://heilancoos.github.io/research/2025/12/16/kubernetes.html#unauthenticated-api-access)](https://heilancoos.github.io/research/2025/12/16/kubernetes.html#unauthenticated-api-access)
- [[https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging](https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging)](https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Discovery
- Tactic: Reconnaissance
- Resources: Investigation Guide
- Noise: Low
- Performance: Normal
- Rule Type: ES|QL
- Platform: GCP
- Domain: Containers
- Platform: Kubernetes

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

## Investigation guide


## Triage and analysis


### Investigating GKE Anonymous Endpoint Permission Enumeration

Anonymous multi-endpoint failure bursts map which APIs are reachable before credential theft or exploitation.
Treat missing `client.user.email` with Unauthorized/failure bursts as anonymous on GKE.

### Investigation steps

- Review `Esql.event_action_values` and `Esql.resource_name_values` for targeted APIs (secrets, RBAC, CRDs).
- Confirm whether `source.ip` is Internet-routable and whether the API endpoint is publicly exposed.
- Hunt for later successful anonymous or authenticated activity from the same source or user agent.


### False positives

- Misconfigured auth proxies that strip credentials can make legitimate clients appear anonymous during outages.


## Rule Query

```esql
from logs-gcp.audit-* metadata _id, _index, _version
| where data_stream.dataset == "gcp.audit"
    and service.name == "k8s.io"
    and (
      client.user.email in ("system:anonymous", "system:unauthenticated")
      or client.user.email is null
    )
    and not gcp.audit.resource_name in ("readyz", "livez", "healthz", "version")
| stats
    Esql.document_count = count(),
    Esql.failure_count = sum(case(event.outcome == "failure", 1, 0)),
    Esql.event_action_count_distinct = count_distinct(event.action),
    Esql.resource_name_count_distinct = count_distinct(gcp.audit.resource_name),
    Esql.event_action_values = values(event.action),
    Esql.resource_name_values = values(gcp.audit.resource_name),
    Esql.event_outcome_values = values(event.outcome),
    Esql.client_user_email_values = values(client.user.email),
    Esql.timestamp = VALUES(@timestamp),
    Esql.data_stream_namespace = VALUES(data_stream.namespace),
    Esql.user_agent_original_values = VALUES(user_agent.original)
  by source.ip
| where Esql.event_action_count_distinct > 5
    and Esql.resource_name_count_distinct > 3
    and Esql.document_count < 50
    and Esql.failure_count >= 1
| keep Esql.*, source.ip
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
  - Id: TA0007
  - Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Container and Resource Discovery
  - Id: T1613
  - Reference URL: [[https://attack.mitre.org/techniques/T1613/](https://attack.mitre.org/techniques/T1613/)](https://attack.mitre.org/techniques/T1613/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Reconnaissance
  - Id: TA0043
  - Reference URL: [[https://attack.mitre.org/tactics/TA0043/](https://attack.mitre.org/tactics/TA0043/)](https://attack.mitre.org/tactics/TA0043/)
- Technique:
  - Name: Active Scanning
  - Id: T1595
  - Reference URL: [[https://attack.mitre.org/techniques/T1595/](https://attack.mitre.org/techniques/T1595/)](https://attack.mitre.org/techniques/T1595/)
- Sub Technique:
  - Name: Wordlist Scanning
  - Id: T1595.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1595/003/](https://attack.mitre.org/techniques/T1595/003/)](https://attack.mitre.org/techniques/T1595/003/)