K8s Secret Created

Severity: INFO
Source: k8saudit

Detect any attempt to create a secret. Service account tokens are excluded.

Telemetry coverage

Platform	Record / event type
Kubernetes	create-secrets: create secrets

Rules detecting the same action

These rules filter on the same operation.

Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
Google Cloud Kubernetes Secrets Modified or Deleted (Sigma)
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy (Elastic)
Kubernetes Secrets Modified or Deleted (Sigma)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    user.username starts_with "system:"
  jevt.rawtime is_not_null
  objectRef.namespace ne "kube-system"
  objectRef.resource eq "secrets"
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`user.username`	starts_with	`system:`	`excludes:user.username` `field:"user.username" value:"system:"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`jevt.rawtime`	is_not_null	(no value, null check)	`field:"jevt.rawtime" kind:is_not_null`
`objectRef.namespace`	ne	`kube-system`	`field:"objectRef.namespace" kind:ne value:"kube-system"`
`objectRef.resource`	eq	`secrets`	`field:"objectRef.resource" kind:eq value:"secrets"`
`responseStatus.code`	starts_with	`2`	`field:"responseStatus.code" kind:starts_with value:"2"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`