Kubernetes audit log signals potential tool and shell enumeration/execution activity

Finds allowed Kubernetes API audit requests with URI-encoded/visible shells or recon tool user agents that may indicate enumeration or secret scanning.

FreeReviewedSigma · Medium · v5

Product: kubernetes
Service: audit
Author: uniqu3-us3r (SigmaHQ), DRL 1.1
Published: 2026-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1609Container Administration Command
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1613Container and Resource Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Kubernetes API audit events that are allowed and whose request URI contains references to common shells and CLI utilities, or encoded tool paths. It also matches user agents indicative of reconnaissance or secret/scanning tools such as access_matrix (Rakkess) and trufflehog. Attackers often use these requests to enumerate cluster capabilities, harvest secrets, or invoke exec-like workflows, and the detection relies on Kubernetes audit telemetry including response status code, requestURI, and userAgent.

Reporting behind it

Related detections9 linkedT1613 — drag to rearrange

Malicious Ingress-nginx Configuration Injection via Kubernetes Audit (via kubernetes)

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

Suspicious Kubernetes Enumeration via kubectl in Cloud Compromise

Suspicious Kubernetes Permission Enumeration via kubectl auth can-i

Suspicious Direct etcd Database Access via etcdctl With Server Certificates (via process_creation)

Suspicious Kubernetes SelfSubjectAccessReview Permission Enumeration

Malicious Kubernetes Reconnaissance Tooling Activity

Suspicious Container Environment Reconnaissance in Serverless Build

Suspicious Command Execution Inside a Kubernetes Pod (via audit)

Kubernetes audit log signals potential tool and shell enumeration/execution activity

Pivot detection · T1613 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

kubernetes-audit-log-signals-potential-enumeration-via-shells-and-recon-tools-597a7e84

title: Kubernetes audit log signals potential tool and shell enumeration/execution activity
id: b21145d9-9faa-4bbf-9106-8bfc3702019e
status: experimental
description: This rule flags Kubernetes API audit events that are allowed and whose request URI contains references to common shells and CLI utilities, or encoded tool paths. It also matches user agents indicative of reconnaissance or secret/scanning tools such as access_matrix (Rakkess) and trufflehog. Attackers often use these requests to enumerate cluster capabilities, harvest secrets, or invoke exec-like workflows, and the detection relies on Kubernetes audit telemetry including response status code, requestURI, and userAgent.
references:
  - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
  - https://github.com/trufflesecurity/trufflehog
  - https://github.com/corneliusweig/rakkess
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
  - attack.execution
  - attack.discovery
  - attack.t1609
  - attack.t1613
logsource:
  product: kubernetes
  service: audit
detection:
  selection_status:
    responseStatus.code: ALLOW
  selection_request_uri:
    requestURI|contains:
      - "%2fbin%2fash"
      - "%2fbin%2fbash"
      - "%2fbin%2fbusybox"
      - "%2fbin%2fdash"
      - "%2fbin%2fsh"
      - "%2fbin%2fzsh"
      - /bin/ash
      - /bin/bash
      - /bin/busybox
      - /bin/dash
      - /bin/sh
      - /bin/zsh
      - "%2fusr%2fbin%2fcurl"
      - "%2fusr%2fbin%2fkubectl"
      - "%2fusr%2fbin%2fperl"
      - "%2fusr%2fbin%2fpython"
      - "%2fusr%2fbin%2fwget"
      - /usr/bin/curl
      - /usr/bin/kubectl
      - /usr/bin/perl
      - /usr/bin/python
      - /usr/bin/wget
  selection_request_user_agent:
    userAgent|contains:
      - access_matrix
      - trufflehog
      - azurehound
      - micro-scanner
  condition: selection_status and 1 of selection_request_*
falsepositives:
  - Authorized administrative maintenance via kubectl
  - Automated internal infrastructure monitoring and certificate rotation
  - Security-approved vulnerability or secret scanning in DevSecOps pipelines
level: medium
license: DRL-1.1
related:
  - id: 597a7e84-187d-458b-9e4f-2f5a0e676711
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL