Kubernetes Audit: Secrets Created, Patched, Replaced, Updated, or Deleted

title: "Kubernetes Audit: Secrets Created, Patched, Replaced, Updated, or Deleted"
id: 5644640a-f322-4af7-a372-0cfd2dd3e2ba
related:
  - id: 2f0bae2d-bf20-4465-be86-1311addebaa3
    type: similar
  - id: 58d31a75-a4f8-4c40-985b-373d58162ca2
    type: derived
status: test
description: This rule flags Kubernetes API audit events where a Secret resource is modified or removed, including create, patch, replace, update, and delete verbs. Attackers may abuse these operations to tamper with credentials or disrupt access by altering or removing stored secrets. Detection relies on Kubernetes audit log records containing the resource type and the verb performed on the Secret object.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.credential-access
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.resource: secrets
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Secrets being modified or deleted may be performed by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1