Kubernetes Audit Log Signals Potential Enumeration via Shells and Recon Tools

Finds allowed Kubernetes API audit requests with URI-encoded/visible shells or recon tool user agents that may indicate enumeration or secret scanning.

FreeUnreviewedSigmamediumv1

kubernetes-audit-log-signals-potential-enumeration-via-shells-and-recon-tools-597a7e84

title: Kubernetes Audit Log Signals Potential Enumeration via Shells and Recon Tools
id: b21145d9-9faa-4bbf-9106-8bfc3702019e
status: experimental
description: This rule flags Kubernetes API audit log entries that are allowed and include request URIs referencing common shell paths or command-line tools, including encoded variants. It also matches user agents containing strings associated with enumeration or reconnaissance utilities (e.g., access_matrix and trufflehog). Attackers may use these API-driven executions and discovery tooling to enumerate cluster resources, harvest secrets, or run commands within a cluster. The detection relies on Kubernetes audit log fields for response status, request URI contents, and user agent identifiers.
references:
  - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
  - https://github.com/trufflesecurity/trufflehog
  - https://github.com/corneliusweig/rakkess
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
  - attack.execution
  - attack.discovery
  - attack.t1609
  - attack.t1613
logsource:
  product: kubernetes
  service: audit
detection:
  selection_status:
    responseStatus.code: ALLOW
  selection_request_uri:
    requestURI|contains:
      - "%2fbin%2fash"
      - "%2fbin%2fbash"
      - "%2fbin%2fbusybox"
      - "%2fbin%2fdash"
      - "%2fbin%2fsh"
      - "%2fbin%2fzsh"
      - /bin/ash
      - /bin/bash
      - /bin/busybox
      - /bin/dash
      - /bin/sh
      - /bin/zsh
      - "%2fusr%2fbin%2fcurl"
      - "%2fusr%2fbin%2fkubectl"
      - "%2fusr%2fbin%2fperl"
      - "%2fusr%2fbin%2fpython"
      - "%2fusr%2fbin%2fwget"
      - /usr/bin/curl
      - /usr/bin/kubectl
      - /usr/bin/perl
      - /usr/bin/python
      - /usr/bin/wget
  selection_request_user_agent:
    userAgent|contains:
      - access_matrix
      - trufflehog
      - azurehound
      - micro-scanner
  condition: selection_status and 1 of selection_request_*
falsepositives:
  - Authorized administrative maintenance via kubectl
  - Automated internal infrastructure monitoring and certificate rotation
  - Security-approved vulnerability or secret scanning in DevSecOps pipelines
level: medium
license: DRL-1.1
related:
  - id: 597a7e84-187d-458b-9e4f-2f5a0e676711
    type: derived

What it detects

This rule flags Kubernetes API audit log entries that are allowed and include request URIs referencing common shell paths or command-line tools, including encoded variants. It also matches user agents containing strings associated with enumeration or reconnaissance utilities (e.g., access_matrix and trufflehog). Attackers may use these API-driven executions and discovery tooling to enumerate cluster resources, harvest secrets, or run commands within a cluster. The detection relies on Kubernetes audit log fields for response status, request URI contents, and user agent identifiers.

Known false positives

Authorized administrative maintenance via kubectl
Automated internal infrastructure monitoring and certificate rotation
Security-approved vulnerability or secret scanning in DevSecOps pipelines

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.