Kubernetes Audit Logs: Listing Secrets for Enumeration

Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.

FreeUnreviewedSigmalowv1

kubernetes-audit-logs-listing-secrets-for-enumeration-eeb3e9e1

title: "Kubernetes Audit Logs: Listing Secrets for Enumeration"
id: 20ad0608-f483-4563-b3fb-53754f283f0a
related:
  - id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
    type: derived
  - id: eeb3e9e1-b685-44e4-9232-6bb701f925b5
    type: derived
status: test
description: This rule flags Kubernetes API audit events where the verb is list and the target resource is secrets, indicating potential enumeration of stored credentials. Attackers may use this information to discover secret names and plan follow-on access attempts. Detection relies on Kubernetes audit log fields for the request verb and the referenced resource (objectRef.resource).
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1552.007
  - attack.credential-access
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: list
    objectRef.resource: secrets
  condition: selection
falsepositives:
  - The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
level: low
license: DRL-1.1

What it detects

This rule flags Kubernetes API audit events where the verb is list and the target resource is secrets, indicating potential enumeration of stored credentials. Attackers may use this information to discover secret names and plan follow-on access attempts. Detection relies on Kubernetes audit log fields for the request verb and the referenced resource (objectRef.resource).

Known false positives

The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.