{"id":"eeb3e9e1-b685-44e4-9232-6bb701f925b5","title":"Kubernetes Secrets Enumeration","description":"Detects enumeration of Kubernetes secrets.","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":"","tags":["attack.t1552.007","attack.credential-access"],"technique_ids":["T1552.007"],"logsource":{"category":"application","product":"kubernetes","service":"audit"},"falsepositives":["The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret"],"references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/"],"source_path":"rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml","source_sha256":"d17df1b9bf165761b2abc9fc690b46e2037eef663c59d719ed9739e3771d1688","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Kubernetes Secrets Enumeration\nid: eeb3e9e1-b685-44e4-9232-6bb701f925b5\nrelated:\n    - id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c\n      type: derived\nstatus: test\ndescription: Detects enumeration of Kubernetes secrets.\nreferences:\n    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n    - attack.t1552.007\n    - attack.credential-access\nlogsource:\n    category: application\n    product: kubernetes\n    service: audit\ndetection:\n    selection:\n        verb: 'list'\n        objectRef.resource: 'secrets'\n    condition: selection\nfalsepositives:\n    - The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.007","id":"T1552.007","name":"Container API","page":"techniques/enterprise/T1552.007/"}],"data_path":"data/detection-rules/eeb3e9e1-b685-44e4-9232-6bb701f925b5.json","kind":"sigma"}