Defense Evasion: Breakglass Workload Deployment Created
Stay organized with collections
Save and categorize content based on your preferences.
This document describes a threat finding type in Security Command Center. Threat findings are generated by
threat detectors when they detect
a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.
Overview
Breakglass Workload Deployment Created is detected by examining Cloud Audit Logs
to see if there are any deployments to workloads that use the breakglass flag to override
Binary Authorization controls.
How to respond
To respond to this finding, do the following:
Step 1: Review finding details
Open the Defense Evasion: Breakglass Workload Deployment Created finding,
as directed in Reviewing findings. The panel for the
finding details opens, displaying the Summary tab.
On the Summary tab, review the information in the following sections:
What was detected, especially the following fields:
Principal email: the account that performed the modification.
Method name: the method that was called.
Kubernetes pods: the pod name and namespace.
Affected resource, especially the following field:
Resource display name: the GKE namespace where
the deployment occurred.
Related links:
Cloud Logging URI: link to Logging entries.
MITRE ATT&CK method: link to the MITRE ATT&CK documentation.
Related findings: links to any related findings.
Step 2: Check logs
On the Summary tab of the finding details in the
Google Cloud console, go to Logs Explorer by clicking the link in the
Cloud Logging URI field.
Check the value in the protoPayload.resourceName field to identify the
specific certificate signing request.
Check for other actions taken by the principal by using the following
filters:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n`Breakglass Workload Deployment Created` is detected by examining Cloud Audit Logs\nto see if there are any deployments to workloads that use the breakglass flag to override\nBinary Authorization controls.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Defense Evasion: Breakglass Workload Deployment Created` finding, as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings). The panel for the finding details opens, displaying the **Summary** tab.\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Principal email**: the account that performed the modification.\n - **Method name**: the method that was called.\n - **Kubernetes pods**: the pod name and namespace.\n - **Affected resource** , especially the following field:\n - **Resource display name**: the GKE namespace where the deployment occurred.\n - **Related links** :\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n\nStep 2: Check logs\n\n1. On the **Summary** tab of the finding details in the Google Cloud console, go to **Logs Explorer** by clicking the link in the **Cloud Logging URI** field.\n2. Check the value in the `protoPayload.resourceName` field to identify the specific certificate signing request.\n3. Check for other actions taken by the principal by using the following\n filters:\n\n - `resource.labels.cluster_name=\"`\u003cvar class=\"edit\" translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e`\"`\n - `protoPayload.authenticationInfo.principalEmail=\"`\u003cvar class=\"edit\" translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e`\"`\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the value that you noted in the\n **Resource display name** field in the finding details.\n\n - \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the value that you noted in the\n **Principal email** field in the finding details.\n\nStep 3: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Defense Evasion: Breakglass Workload Deployment](https://attack.mitre.org/techniques/T1548/).\n2. Review related findings by clicking the link on the **Related findings** on the **Related findings** row in the **Summary** tab of the finding details.\n3. To develop a response plan, combine your investigation results with MITRE research.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]