Known false positives
- The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | list-secrets: list secrets |
Rules detecting the same action
These rules filter on the same operation.
- Azure AKS Secret get or list with Suspicious User Agent (Elastic)
- Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
- GKE Secret Access from Node or Denied Service Account (Elastic)
- GKE Secret Access via Unusual User Agent (Elastic)
- GKE Secret get or list with Suspicious User Agent (Elastic)
- GKE Secrets List from Unusual Source AS Organization (Elastic)
- Kubernetes All Secrets Dumped Across Namespaces (Panther)
- Kubernetes Secret Access via Unusual User Agent (Elastic)
Rule body
title: Kubernetes Secrets Enumeration
id: eeb3e9e1-b685-44e4-9232-6bb701f925b5
related:
- id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
type: derived
status: test
description: Detects enumeration of Kubernetes secrets.
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
- attack.t1552.007
- attack.credential-access
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: 'list'
objectRef.resource: 'secrets'
condition: selection
falsepositives:
- The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
verb: 'list'
objectRef.resource: 'secrets'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"secrets" |
verb | eq |
| field:"verb" kind:eq value:"list" |