Defense Evasion: Breakglass Workload Deployment Created

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Overview

Breakglass Workload Deployment Created is detected by examining Cloud Audit Logs to see if there are any deployments to workloads that use the breakglass flag to override Binary Authorization controls.

Event Threat Detection is the source of this finding.

How to respond

To respond to this finding, do the following:

Step 1: Review finding details

  1. Open the Defense Evasion: Breakglass Workload Deployment Created finding, as directed in Reviewing findings. The panel for the finding details opens, displaying the Summary tab.

  2. On the Summary tab, review the information in the following sections:

    • What was detected, especially the following fields:
      • Principal email: the account that performed the modification.
      • Method name: the method that was called.
      • Kubernetes pods: the pod name and namespace.
    • Affected resource, especially the following field:
      • Resource display name: the GKE namespace where the deployment occurred.
    • Related links:
      • Cloud Logging URI: link to Logging entries.
      • MITRE ATT&CK method: link to the MITRE ATT&CK documentation.
      • Related findings: links to any related findings.

Step 2: Check logs

  1. On the Summary tab of the finding details in the Google Cloud console, go to Logs Explorer by clicking the link in the Cloud Logging URI field.
  2. Check the value in the protoPayload.resourceName field to identify the specific certificate signing request.

  3. Check for other actions taken by the principal by using the following filters:

    • resource.labels.cluster_name="CLUSTER_NAME"

    • protoPayload.authenticationInfo.principalEmail="PRINCIPAL_EMAIL"

      Replace the following:

    • CLUSTER_NAME: the value that you noted in the Resource display name field in the finding details.

    • PRINCIPAL_EMAIL: the value that you noted in the Principal email field in the finding details.

Step 3: Research attack and response methods

  1. Review the MITRE ATT&CK framework entry for this finding type: Defense Evasion: Breakglass Workload Deployment.
  2. Review related findings by clicking the link on the Related findings on the Related findings row in the Summary tab of the finding details.
  3. To develop a response plan, combine your investigation results with MITRE research.

What's next