Kubernetes Secrets Enumeration

Title: Kubernetes Secrets Enumeration
Status: test
Description:Detects enumeration of Kubernetes secrets.
References:
  -https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
modified:None
Tags:

• -'attack.t1552.007'
• -'attack.credential-access'

Logsource:

• category: application
• product: kubernetes
• service: audit

Detection:
  selection:
    verb: 'list'
    objectRef.resource: 'secrets'
  condition:selection
Falsepositives:
  -The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
Level: low