Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)
Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.
- Product
- kubernetes
- Category
- application
- Author
- Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Kubernetes API audit events where an actor uses the list verb against the secrets resource, indicating attempted enumeration of stored credentials or configuration. Attackers often enumerate secrets to identify valuable data before attempting access or extraction. The detection relies on Kubernetes audit telemetry that records the requested verb and the target resource type.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)"
id: 20ad0608-f483-4563-b3fb-53754f283f0a
related:
- id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
type: derived
- id: eeb3e9e1-b685-44e4-9232-6bb701f925b5
type: derived
status: test
description: This rule flags Kubernetes API audit events where an actor uses the list verb against the secrets resource, indicating attempted enumeration of stored credentials or configuration. Attackers often enumerate secrets to identify valuable data before attempting access or extraction. The detection relies on Kubernetes audit telemetry that records the requested verb and the target resource type.
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
- attack.t1552.007
- attack.credential-access
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: list
objectRef.resource: secrets
condition: selection
falsepositives:
- The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
level: low
license: DRL-1.1