GCP Kubernetes Audit: Secrets Modified or Deleted via Kubernetes API Methods

title: "GCP Kubernetes Audit: Secrets Modified or Deleted via Kubernetes API Methods"
id: d3fea0c9-b23f-4dfe-839e-d446c5fa4324
status: test
description: This rule flags Google Cloud audit log events where Kubernetes Secrets are created, updated, patched, or deleted through Kubernetes API method calls. Attackers may modify or remove Secrets to disrupt workloads, change credentials, or prepare for credential access. It relies on GCP audit telemetry containing Kubernetes audit method_name values that match the Secrets operations.
references:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-09
modified: 2022-10-09
tags:
  - attack.credential-access
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - io.k8s.core.v*.secrets.create
      - io.k8s.core.v*.secrets.update
      - io.k8s.core.v*.secrets.patch
      - io.k8s.core.v*.secrets.delete
  condition: selection
falsepositives:
  - Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 2f0bae2d-bf20-4465-be86-1311addebaa3
    type: derived