Kubernetes audit log signals potential tool and shell enumeration/execution activity

Finds allowed Kubernetes API audit requests with URI-encoded/visible shells or recon tool user agents that may indicate enumeration or secret scanning.

FreeReviewedSigma · Medium · v5

Product: kubernetes
Service: audit
Author: uniqu3-us3r (SigmaHQ), DRL 1.1
Published: 2026-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1609Container Administration Command
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1613Container and Resource Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Kubernetes API audit events that are allowed and whose request URI contains references to common shells and CLI utilities, or encoded tool paths. It also matches user agents indicative of reconnaissance or secret/scanning tools such as access_matrix (Rakkess) and trufflehog. Attackers often use these requests to enumerate cluster capabilities, harvest secrets, or invoke exec-like workflows, and the detection relies on Kubernetes audit telemetry including response status code, requestURI, and userAgent.

Reporting behind it

Related detections9 linkedT1613 — drag to rearrange

Suspicious Container Environment Reconnaissance in Serverless Build

Suspicious Command Execution Inside a Kubernetes Pod (via audit)

Suspicious Kubernetes Secret Enumeration via kubectl

Suspicious Kubernetes API Request From Anonymous User

Suspicious Kubernetes Secret and Permission Enumeration via kubectl (via process_creation)

Malicious Direct etcd Write to Kubernetes Registry via ETCDCTL_API (via process_creation)

Suspicious Anonymous Access to Kubernetes API Server via Audit Log

Kubernetes Pod exec via API creates exec subresource requests

Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments

Kubernetes audit log signals potential tool and shell enumeration/execution activity

Pivot detection · T1613 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

kubernetes-audit-log-signals-potential-enumeration-via-shells-and-recon-tools-597a7e84

title: Kubernetes audit log signals potential tool and shell enumeration/execution activity
id: b21145d9-9faa-4bbf-9106-8bfc3702019e
status: experimental
description: This rule flags Kubernetes API audit events that are allowed and whose request URI contains references to common shells and CLI utilities, or encoded tool paths. It also matches user agents indicative of reconnaissance or secret/scanning tools such as access_matrix (Rakkess) and trufflehog. Attackers often use these requests to enumerate cluster capabilities, harvest secrets, or invoke exec-like workflows, and the detection relies on Kubernetes audit telemetry including response status code, requestURI, and userAgent.
references:
  - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
  - https://github.com/trufflesecurity/trufflehog
  - https://github.com/corneliusweig/rakkess
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
  - attack.execution
  - attack.discovery
  - attack.t1609
  - attack.t1613
logsource:
  product: kubernetes
  service: audit
detection:
  selection_status:
    responseStatus.code: ALLOW
  selection_request_uri:
    requestURI|contains:
      - "%2fbin%2fash"
      - "%2fbin%2fbash"
      - "%2fbin%2fbusybox"
      - "%2fbin%2fdash"
      - "%2fbin%2fsh"
      - "%2fbin%2fzsh"
      - /bin/ash
      - /bin/bash
      - /bin/busybox
      - /bin/dash
      - /bin/sh
      - /bin/zsh
      - "%2fusr%2fbin%2fcurl"
      - "%2fusr%2fbin%2fkubectl"
      - "%2fusr%2fbin%2fperl"
      - "%2fusr%2fbin%2fpython"
      - "%2fusr%2fbin%2fwget"
      - /usr/bin/curl
      - /usr/bin/kubectl
      - /usr/bin/perl
      - /usr/bin/python
      - /usr/bin/wget
  selection_request_user_agent:
    userAgent|contains:
      - access_matrix
      - trufflehog
      - azurehound
      - micro-scanner
  condition: selection_status and 1 of selection_request_*
falsepositives:
  - Authorized administrative maintenance via kubectl
  - Automated internal infrastructure monitoring and certificate rotation
  - Security-approved vulnerability or secret scanning in DevSecOps pipelines
level: medium
license: DRL-1.1
related:
  - id: 597a7e84-187d-458b-9e4f-2f5a0e676711
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL