K8s Secret Deleted

Severity: INFO
Source: k8saudit

Detect any attempt to delete a secret. Service account tokens are excluded.

Telemetry coverage

Platform	Record / event type
Kubernetes	delete-secrets: delete secrets

Rules detecting the same action

These rules filter on the same operation.

Google Cloud Kubernetes Secrets Modified or Deleted (Sigma)
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy (Elastic)
Kubernetes Secrets Modified or Deleted (Sigma)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    user.username starts_with "system:"
  jevt.rawtime is_not_null
  objectRef.namespace ne "kube-system"
  objectRef.resource eq "secrets"
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "delete"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`user.username`	starts_with	`system:`	`excludes:user.username` `field:"user.username" value:"system:"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`jevt.rawtime`	is_not_null	(no value, null check)	`field:"jevt.rawtime" kind:is_not_null`
`objectRef.namespace`	ne	`kube-system`	`field:"objectRef.namespace" kind:ne value:"kube-system"`
`objectRef.resource`	eq	`secrets`	`field:"objectRef.resource" kind:eq value:"secrets"`
`responseStatus.code`	starts_with	`2`	`field:"responseStatus.code" kind:starts_with value:"2"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`delete`	`field:"verb" kind:eq value:"delete"`