Possible Kubernetes Secrets Enumeration (via application)

title: Possible Kubernetes Secrets Enumeration (via application)
id: 405cfe56-44df-5a54-90e4-eab2b49de096
status: stable
description: This rule detects enumeration of Kubernetes secrets.
references:
    - https://attack.mitre.org/techniques/T1552/007/
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
author: Huntrule Team
date: 2026-05-22
tags:
    - attack.t1552.007
    - attack.credential-access
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'list'
        objectRef.resource: 'secrets'
    condition: selection
falsepositives:
    - Unknown
level: low