Elastic high stable kql

Kubernetes Secrets List Across Cluster or Sensitive Namespaces

Detects list operations on Kubernetes Secrets from a non-loopback client when the request URI targets cluster-wide secrets or list operations under kube-system or default. Useful for spotting broad secret enumeration from remote clients.

View Source

Detection Logic

event.dataset:"kubernetes.audit_logs" and event.action:list and 
kubernetes.audit.objectRef.resource:secrets and 
kubernetes.audit.requestURI :(/api/v1/secrets or /api/v1/secrets?limit* or /api/v1/namespaces/kube-system/secrets or /api/v1/namespaces/kube-system/secrets?limit* or /api/v1/namespaces/default/secrets or /api/v1/namespaces/default/secrets?limit*) and 
source.ip:(* and not ("::1" or "127.0.0.1")) and 
not user.name: (system\:kube-controller-manager or eks\:cloud-controller-manager or eks\:kms-storage-migrator or "system:serviceaccount:argocd:argocd-application-controller" or "system:serviceaccount:elastic:kube-state-metrics" or "system:serviceaccount:cert-manager:cert-manager-cainjector" or "system:serviceaccount:elastic-system:elastic-agent" or "system:serviceaccount:longhorn-system:longhorn-service-account") and 
not kubernetes.audit.user.groups:("system:serviceaccounts:ibm-csi" or "system:serviceaccounts:argocd" or "system:serviceaccounts:elastic")

Field Validations

Loading…

Comments (0)

Loading comments...