{"id":"597a7e84-187d-458b-9e4f-2f5a0e676711","title":"Kubernetes Potential Enumeration Activity","description":"Detects potential Kubernetes enumeration or attack activity via the audit log.\nThis includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.\nAttackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.\n","author":"uniqu3-us3r","status":"experimental","level":"medium","date":"2026-04-28","modified":"","tags":["attack.execution","attack.discovery","attack.t1609","attack.t1613"],"technique_ids":["T1609","T1613"],"logsource":{"product":"kubernetes","service":"audit"},"falsepositives":["Authorized administrative maintenance via kubectl","Automated internal infrastructure monitoring and certificate rotation","Security-approved vulnerability or secret scanning in DevSecOps pipelines"],"references":["https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/","https://github.com/trufflesecurity/trufflehog","https://github.com/corneliusweig/rakkess"],"source_path":"rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml","source_sha256":"655efe6ff52c0853eb1640aa2de0867e37d8a67746e48f1f31d687b1b3025ffe","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Kubernetes Potential Enumeration Activity\nid: 597a7e84-187d-458b-9e4f-2f5a0e676711\nstatus: experimental\ndescription: |\n    Detects potential Kubernetes enumeration or attack activity via the audit log.\n    This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.\n    Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.\nreferences:\n    - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/\n    - https://github.com/trufflesecurity/trufflehog\n    - https://github.com/corneliusweig/rakkess\nauthor: uniqu3-us3r\ndate: 2026-04-28\ntags:\n    - attack.execution\n    - attack.discovery\n    - attack.t1609\n    - attack.t1613\nlogsource:\n    product: kubernetes\n    service: audit\ndetection:\n    selection_status:\n        responseStatus.code: 'ALLOW'\n    selection_request_uri:\n        requestURI|contains:\n            # Shells Encoded\n            - '%2fbin%2fash'\n            - '%2fbin%2fbash'\n            - '%2fbin%2fbusybox'\n            - '%2fbin%2fdash'\n            - '%2fbin%2fsh'\n            - '%2fbin%2fzsh'\n            # Shells Plain\n            - '/bin/ash'\n            - '/bin/bash'\n            - '/bin/busybox'\n            - '/bin/dash'\n            - '/bin/sh'\n            - '/bin/zsh'\n            # Tools Encoded\n            - '%2fusr%2fbin%2fcurl'\n            - '%2fusr%2fbin%2fkubectl'\n            - '%2fusr%2fbin%2fperl'\n            - '%2fusr%2fbin%2fpython'\n            - '%2fusr%2fbin%2fwget'\n            # Tools Plain\n            - '/usr/bin/curl'\n            - '/usr/bin/kubectl'\n            - '/usr/bin/perl'\n            - '/usr/bin/python'\n            - '/usr/bin/wget'\n    selection_request_user_agent:\n        userAgent|contains:\n            - 'access_matrix'  # Rakkess\n            - 'trufflehog'     # Secret scanning tool\n            - 'azurehound'     # Azure/Cloud discovery\n            - 'micro-scanner'  # Vulnerability scanning\n    condition: selection_status and 1 of selection_request_*\nfalsepositives:\n    - Authorized administrative maintenance via kubectl\n    - Automated internal infrastructure monitoring and certificate rotation\n    - Security-approved vulnerability or secret scanning in DevSecOps pipelines\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1609","id":"T1609","name":"Container Administration Command","page":"techniques/enterprise/T1609/"},{"key":"enterprise/T1613","id":"T1613","name":"Container and Resource Discovery","page":"techniques/enterprise/T1613/"}],"data_path":"data/detection-rules/597a7e84-187d-458b-9e4f-2f5a0e676711.json","kind":"sigma"}