Kubernetes Secret Access by Node or Pod Identities

Kubernetes environments face significant risk from credential access techniques where compromised pod service accounts or node identities (kubelet) are used to query the Kubernetes API for sensitive secrets. Because these identities are meant to operate with predictable, limited API access, direct enumeration of 'Secrets' objects is highly anomalous. Attackers utilize these stolen tokens or node credentials to sweep the cluster for registry credentials, TLS certificates, private keys, and application configuration. This behavior is particularly dangerous as it enables lateral movement and privilege escalation. While some legitimate in-cluster controllers perform these actions, unauthorized use by service accounts or nodes - especially those originating from non-local IP addresses - indicates malicious intent to access protected material. Defensive teams must monitor Kubernetes API server audit logs to detect these unauthorized read operations.

Impact

Successful exploitation allows attackers to bypass security boundaries and exfiltrate sensitive data stored within Kubernetes Secrets. This can lead to full cluster compromise, unauthorized access to external services through exposed registry credentials, and the potential for persistent backdoors. The scope of impact includes any workload, infrastructure component, or secret managed within the cluster namespace.

Recommendation

• Deploy the Sigma rules provided in this brief to detect unauthorized 'get' or 'list' requests on the Secrets API from nodes and service accounts.
• Establish a baseline for legitimate service account activity to identify anomalous user agents, namespace access, or resource requests.
• Implement least-privilege RBAC policies, ensuring that service accounts and node identities only have access to the specific secrets required for their function.
• Monitor Kubernetes audit logs for authorization_k8s_io/decision field values that indicate denied access attempts, as these serve as early warning signs of discovery activity.
• Rotate credentials and revoke tokens immediately upon detecting unauthorized secret enumeration.