Kubernetes Audit: Secrets Created, Patched, Replaced, Updated, or Deleted
Flags Kubernetes audit events where Secret resources are created, updated, patched, replaced, or deleted.
FreeReviewedSigma · Medium · v5
- Product
- kubernetes
- Service
- audit
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-31
What it detects
This rule flags Kubernetes API audit events where a Secret resource is modified or removed, including create, patch, replace, update, and delete verbs. Attackers may abuse these operations to tamper with credentials or disrupt access by altering or removing stored secrets. Detection relies on Kubernetes audit log records containing the resource type and the verb performed on the Secret object.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
kubernetes-audit-secrets-modified-or-deleted-via-api-verbs-58d31a75
title: "Kubernetes Audit: Secrets Created, Patched, Replaced, Updated, or Deleted"
id: 5644640a-f322-4af7-a372-0cfd2dd3e2ba
related:
- id: 2f0bae2d-bf20-4465-be86-1311addebaa3
type: similar
- id: 58d31a75-a4f8-4c40-985b-373d58162ca2
type: derived
status: test
description: This rule flags Kubernetes API audit events where a Secret resource is modified or removed, including create, patch, replace, update, and delete verbs. Attackers may abuse these operations to tamper with credentials or disrupt access by altering or removing stored secrets. Detection relies on Kubernetes audit log records containing the resource type and the verb performed on the Secret object.
references:
- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
- attack.credential-access
logsource:
product: kubernetes
service: audit
detection:
selection:
objectRef.resource: secrets
verb:
- create
- delete
- patch
- replace
- update
condition: selection
falsepositives:
- Secrets being modified or deleted may be performed by a system administrator.
- Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1