Detection rules › By event

Kubernetes-secrets

Event	Rules
get-secrets	20
list-secrets	14
watch-secrets	4
create-secrets	5
update-secrets	4
patch-secrets	4
delete-secrets	4
any-secrets	5

get-secrets

20 detection rules reference this event. View event page.

Elastic (10)

Azure AKS Secret get or list with Suspicious User Agent severity high T1552, T1552.007
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Rapid Secret GET Activity Against Multiple Objects severity high T1552, T1552.007
GKE Secret Access from Node or Denied Service Account severity medium T1552, T1552.007
GKE Secret Access via Unusual User Agent severity low T1552, T1552.007
GKE Secret get or list with Suspicious User Agent severity high T1552, T1552.007
GKE Unusual Service Account Secret Access via New User Agent severity low T1552, T1552.007
Kubernetes Secret Access via Unusual User Agent severity low T1552, T1552.007
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001
Multiple Cloud Secrets Accessed by Source Address severity high T1555, T1555.006

Splunk (4)

Kubernetes Abuse of Secret by Unusual Location severity low T1552, T1552.007
Kubernetes Abuse of Secret by Unusual User Agent severity low T1552, T1552.007
Kubernetes Abuse of Secret by Unusual User Group severity low T1552, T1552.007
Kubernetes Abuse of Secret by Unusual User Name severity low T1552, T1552.007

Panther (4)

Kubernetes Secret Access Denied severity medium T1552.007, T1613
Kubernetes Secret Enumeration by a User severity medium T1552.007
Secret Enumeration by a User severity medium
Secret Enumeration by a User

Falco (2)

K8s Secret Get Successfully severity ERROR
K8s Secret Get Unsuccessfully Tried severity WARNING

list-secrets

14 detection rules reference this event. View event page.

Sigma (1)

Kubernetes Secrets Enumeration severity low T1552, T1552.007

Elastic (9)

Azure AKS Secret get or list with Suspicious User Agent severity high T1552, T1552.007
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Secret Access from Node or Denied Service Account severity medium T1552, T1552.007
GKE Secret Access via Unusual User Agent severity low T1552, T1552.007
GKE Secret get or list with Suspicious User Agent severity high T1552, T1552.007
GKE Secrets List from Unusual Source AS Organization severity high T1552, T1552.007, T1613
Kubernetes Secret Access via Unusual User Agent severity low T1552, T1552.007
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001
Multiple Cloud Secrets Accessed by Source Address severity high T1555, T1555.006

Panther (4)

Kubernetes All Secrets Dumped Across Namespaces severity critical T1530, T1552.007
Kubernetes Secret Enumeration by a User severity medium T1552.007
Secret Enumeration by a User severity medium
Secret Enumeration by a User

watch-secrets

4 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Panther (3)

Kubernetes Secret Enumeration by a User severity medium T1552.007
Secret Enumeration by a User severity medium
Secret Enumeration by a User

create-secrets

5 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes Secrets Modified or Deleted severity medium
Kubernetes Secrets Modified or Deleted severity medium

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

Falco (1)

K8s Secret Created severity INFO

update-secrets

4 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes Secrets Modified or Deleted severity medium
Kubernetes Secrets Modified or Deleted severity medium

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

patch-secrets

4 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes Secrets Modified or Deleted severity medium
Kubernetes Secrets Modified or Deleted severity medium

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

delete-secrets

4 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes Secrets Modified or Deleted severity medium
Kubernetes Secrets Modified or Deleted severity medium

Elastic (1)

Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

Falco (1)

K8s Secret Deleted severity INFO

any-secrets

5 detection rules reference this event. View event page.

Elastic (5)

Kubernetes Rapid Secret GET Activity Against Multiple Objects severity high T1552, T1552.007
Kubernetes Secret get or list from Node or Pod Service Account severity medium T1552, T1552.007
Kubernetes Secret get or list with Suspicious User Agent severity high T1552, T1552.007
Kubernetes Secrets List Across Cluster or Sensitive Namespaces severity high T1552, T1552.007, T1613
Kubernetes Unusual Decision by User Agent severity low T1078