Elastic high stable eql

Kubectl Secrets Enumeration Across All Namespaces

This rule detects the use of the "kubectl get secrets --all-namespaces" command, which enumerates secret resources across the entire Kubernetes cluster. Attackers may use this command to identify accessible secrets in multiple namespaces, aiding credential discovery, privilege escalation, or lateral movement.

View Source

Detection Logic

process where host.os.type in ("linux", "macos") and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "kubectl" and process.args in ("get", "describe") and process.args in ("secret", "secrets") and
process.args in ("--all-namespaces", "-A")

Field Validations

Loading…

Comments (0)

Loading comments...