Detect Container API in Google Chronicle

rule container_api_credential_access {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1552.007 — credential access via Docker and Kubernetes container APIs, including kubectl secret enumeration, Docker CLI credential extraction, docker.sock unauthorized access, and Kubernetes API secret reads."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1552.007"
    mitre_attack_subtechnique = "Container API"
    reference = "https://attack.mitre.org/techniques/T1552/007/"

  events:
    (
      // Pattern 1: kubectl targeting secrets, service accounts, configmaps
      $kubectl_event.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($kubectl_event.target.process.file.full_path, `(^|/)kubectl$`)
      and (
        re.regex($kubectl_event.target.process.command_line, `kubectl\s+(get|describe|edit|patch)\s+(secret|secrets|sa|serviceaccount|serviceaccounts|configmap|configmaps)`)
        or re.regex($kubectl_event.target.process.command_line, `kubectl\s+exec\s+`)
        or re.regex($kubectl_event.target.process.command_line, `kubectl\s+logs\s+`)
        or re.regex($kubectl_event.target.process.command_line, `kubectl\s+get\s+pods\s+-o`)
      )
    )
    or (
      // Pattern 2: Docker CLI credential extraction
      $docker_event.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($docker_event.target.process.file.full_path, `(^|/)docker$`)
      and re.regex($docker_event.target.process.command_line, `docker\s+(inspect|logs|exec|env|cp|run)`)
      and re.regex($docker_event.target.process.command_line, `(pass|secret|token|credential|key|aws|gcp|azure)`)
    )
    or (
      // Pattern 3: Unauthorized docker.sock access
      $sock_event.metadata.event_type = "FILE_OPEN"
      and $sock_event.target.file.full_path = "/var/run/docker.sock"
      and not re.regex($sock_event.principal.process.file.full_path, `(^|/)(dockerd|containerd|docker-proxy|docker|moby|cri-dockerd)$`)
    )
    or (
      // Pattern 4: Kubernetes API audit — secret enumeration
      $k8s_event.metadata.event_type = "RESOURCE_READ"
      and $k8s_event.metadata.product_name = "Kubernetes"
      and $k8s_event.target.resource.type = "secrets"
      and $k8s_event.network.http.method = "GET"
      and not re.regex($k8s_event.principal.user.userid, `^system:(serviceaccount:kube-system:|node:)`)
    )

  condition:
    $kubectl_event or $docker_event or $sock_event or $k8s_event
}