Suspicious Kubernetes Secrets Modified or Deleted (via audit)

title: Suspicious Kubernetes Secrets Modified or Deleted (via audit)
id: beb7289a-5294-52cd-8042-4ba820464fcd
status: stable
description: This rule detects when Kubernetes Secrets are Modified or Deleted.
references:
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/
author: Huntrule Team
date: 2026-04-21
tags:
    - attack.credential-access
    - attack.t1552.007
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.resource: 'secrets'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection
falsepositives:
    - Unknown
level: medium