GCP Kubernetes Engine audit logs: Secrets created, updated, patched, or deleted

title: "GCP Kubernetes Engine audit logs: Secrets created, updated, patched, or deleted"
id: d3fea0c9-b23f-4dfe-839e-d446c5fa4324
status: test
description: This rule flags Google Cloud audit events for Kubernetes Secrets when they are created, updated, patched, or deleted. Attackers may modify or remove Secrets to disrupt workloads or gain access to sensitive credentials. It relies on GCP Kubernetes audit log method_name values for Kubernetes core Secret lifecycle operations.
references:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-09
modified: 2022-10-09
tags:
  - attack.credential-access
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - io.k8s.core.v*.secrets.create
      - io.k8s.core.v*.secrets.update
      - io.k8s.core.v*.secrets.patch
      - io.k8s.core.v*.secrets.delete
  condition: selection
falsepositives:
  - Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 2f0bae2d-bf20-4465-be86-1311addebaa3
    type: derived