GCP Kubernetes Engine audit logs: Secrets created, updated, patched, or deleted
Alerts on GCP Kubernetes audit events showing Secrets being updated, patched, or deleted via Kubernetes API calls.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-09
- Updated
- 2026-07-31
What it detects
This rule flags Google Cloud audit events for Kubernetes Secrets when they are created, updated, patched, or deleted. Attackers may modify or remove Secrets to disrupt workloads or gain access to sensitive credentials. It relies on GCP Kubernetes audit log method_name values for Kubernetes core Secret lifecycle operations.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
gcp-kubernetes-audit-secrets-modified-or-deleted-via-kubernetes-api-methods-2f0bae2d
title: "GCP Kubernetes Engine audit logs: Secrets created, updated, patched, or deleted"
id: d3fea0c9-b23f-4dfe-839e-d446c5fa4324
status: test
description: This rule flags Google Cloud audit events for Kubernetes Secrets when they are created, updated, patched, or deleted. Attackers may modify or remove Secrets to disrupt workloads or gain access to sensitive credentials. It relies on GCP Kubernetes audit log method_name values for Kubernetes core Secret lifecycle operations.
references:
- https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-09
modified: 2022-10-09
tags:
- attack.credential-access
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- io.k8s.core.v*.secrets.create
- io.k8s.core.v*.secrets.update
- io.k8s.core.v*.secrets.patch
- io.k8s.core.v*.secrets.delete
condition: selection
falsepositives:
- Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 2f0bae2d-bf20-4465-be86-1311addebaa3
type: derived