Kubernetes audit log signals potential tool and shell enumeration/execution activity
Finds allowed Kubernetes API audit requests with URI-encoded/visible shells or recon tool user agents that may indicate enumeration or secret scanning.
- Product
- kubernetes
- Service
- audit
- Author
- uniqu3-us3r (SigmaHQ), DRL 1.1
- Published
- 2026-04-28
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Kubernetes API audit events that are allowed and whose request URI contains references to common shells and CLI utilities, or encoded tool paths. It also matches user agents indicative of reconnaissance or secret/scanning tools such as access_matrix (Rakkess) and trufflehog. Attackers often use these requests to enumerate cluster capabilities, harvest secrets, or invoke exec-like workflows, and the detection relies on Kubernetes audit telemetry including response status code, requestURI, and userAgent.
Reporting behind it
- nccgroup.comhttps://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
- github.comhttps://github.com/trufflesecurity/trufflehog
- github.comhttps://github.com/corneliusweig/rakkess
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Kubernetes audit log signals potential tool and shell enumeration/execution activity
id: b21145d9-9faa-4bbf-9106-8bfc3702019e
status: experimental
description: This rule flags Kubernetes API audit events that are allowed and whose request URI contains references to common shells and CLI utilities, or encoded tool paths. It also matches user agents indicative of reconnaissance or secret/scanning tools such as access_matrix (Rakkess) and trufflehog. Attackers often use these requests to enumerate cluster capabilities, harvest secrets, or invoke exec-like workflows, and the detection relies on Kubernetes audit telemetry including response status code, requestURI, and userAgent.
references:
- https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
- https://github.com/trufflesecurity/trufflehog
- https://github.com/corneliusweig/rakkess
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
- attack.execution
- attack.discovery
- attack.t1609
- attack.t1613
logsource:
product: kubernetes
service: audit
detection:
selection_status:
responseStatus.code: ALLOW
selection_request_uri:
requestURI|contains:
- "%2fbin%2fash"
- "%2fbin%2fbash"
- "%2fbin%2fbusybox"
- "%2fbin%2fdash"
- "%2fbin%2fsh"
- "%2fbin%2fzsh"
- /bin/ash
- /bin/bash
- /bin/busybox
- /bin/dash
- /bin/sh
- /bin/zsh
- "%2fusr%2fbin%2fcurl"
- "%2fusr%2fbin%2fkubectl"
- "%2fusr%2fbin%2fperl"
- "%2fusr%2fbin%2fpython"
- "%2fusr%2fbin%2fwget"
- /usr/bin/curl
- /usr/bin/kubectl
- /usr/bin/perl
- /usr/bin/python
- /usr/bin/wget
selection_request_user_agent:
userAgent|contains:
- access_matrix
- trufflehog
- azurehound
- micro-scanner
condition: selection_status and 1 of selection_request_*
falsepositives:
- Authorized administrative maintenance via kubectl
- Automated internal infrastructure monitoring and certificate rotation
- Security-approved vulnerability or secret scanning in DevSecOps pipelines
level: medium
license: DRL-1.1
related:
- id: 597a7e84-187d-458b-9e4f-2f5a0e676711
type: derived