Suspicious Google Cloud Kubernetes Secrets Modified or Deleted (via gcp.audit)

title: Suspicious Google Cloud Kubernetes Secrets Modified or Deleted (via gcp.audit)
id: d5e16496-019b-5bb8-b05a-4cb474555773
status: stable
description: This rule detects when the Secrets are Modified or Deleted.
references:
    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
author: Huntrule Team
date: 2026-06-21
tags:
    - attack.credential-access
    - attack.t1552.007
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - io.k8s.core.v*.secrets.create
            - io.k8s.core.v*.secrets.update
            - io.k8s.core.v*.secrets.patch
            - io.k8s.core.v*.secrets.delete
    condition: selection
falsepositives:
    - Unknown
level: medium