{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","description":"Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"technique_ids":["T1485","T1489","T1496"],"logsource":{"product":"azure","service":"activitylogs"},"falsepositives":["Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."],"references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"source_path":"rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","source_sha256":"e08d5d853c6faf9693a9590a29fba896ac4641ba89dc36040077df2964648352","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Azure Kubernetes Secret or Config Object Access\nid: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c\nstatus: test\ndescription: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.\nreferences:\n    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n    - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n    - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n    - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n    - attack.impact\n    - attack.t1485\n    - attack.t1496\n    - attack.t1489\nlogsource:\n    product: azure\n    service: activitylogs\ndetection:\n    selection:\n        operationName:\n            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE\n            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE\n            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE\n            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE\n    condition: selection\nfalsepositives:\n    - Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","page":"techniques/enterprise/T1485/"},{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","page":"techniques/enterprise/T1489/"},{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","page":"techniques/enterprise/T1496/"}],"data_path":"data/detection-rules/7ee0b4aa-d8d4-4088-b661-20efdf41a04c.json","kind":"sigma"}