Kubernetes Audit: Secrets Modified or Deleted via API Verbs

Flags Kubernetes audit events where Secret resources are created, updated, patched, replaced, or deleted.

FreeUnreviewedSigmamediumv1

kubernetes-audit-secrets-modified-or-deleted-via-api-verbs-58d31a75

title: "Kubernetes Audit: Secrets Modified or Deleted via API Verbs"
id: 5644640a-f322-4af7-a372-0cfd2dd3e2ba
related:
  - id: 2f0bae2d-bf20-4465-be86-1311addebaa3
    type: similar
  - id: 58d31a75-a4f8-4c40-985b-373d58162ca2
    type: derived
status: test
description: This rule identifies Kubernetes API audit events where a Secret resource is the target and the operation verb is create, delete, patch, replace, or update. Secret changes and removals are sensitive actions that attackers can abuse to tamper with credentials or disrupt application access. The detection relies on Kubernetes audit log telemetry capturing objectRef.resource and the verb associated with the request.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.credential-access
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.resource: secrets
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Secrets being modified or deleted may be performed by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1

What it detects

This rule identifies Kubernetes API audit events where a Secret resource is the target and the operation verb is create, delete, patch, replace, or update. Secret changes and removals are sensitive actions that attackers can abuse to tamper with credentials or disrupt application access. The detection relies on Kubernetes audit log telemetry capturing objectRef.resource and the verb associated with the request.

Known false positives

Secrets being modified or deleted may be performed by a system administrator.
Automated processes may need to take these actions and may need to be filtered.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.