Detection of Unauthorized Kubernetes Secrets Enumeration

This detection brief addresses the risk of credential access and environment discovery within Kubernetes clusters via the Kubernetes API. Attackers who obtain unauthorized access to the API often seek to enumerate secret resources to extract sensitive credentials, tokens, or configuration keys. This behavior is often characterized by non-loopback clients executing 'list' operations against the /api/v1/secrets endpoint, or specifically targeting high-privilege namespaces such as kube-system or default.

By monitoring Kubernetes audit logs for these patterns, security operations teams can identify potential reconnaissance or credential dumping activity. The detection logic is designed to filter out known-benign system controllers and service accounts to minimize noise, focusing investigation on unexpected API consumers that exhibit broad enumeration behavior. Defenders should prioritize auditing the source IP and user agent of these requests to determine the legitimacy of the API consumer.

Attack Chain

1. Attacker gains initial access to a container, a compromised pod, or an leaked Kubeconfig file.
2. Attacker verifies API server reachability and their own RBAC permissions.
3. Attacker executes a 'list' operation against the /api/v1/secrets endpoint for discovery.
4. Attacker specifically targets kube-system or default namespaces to identify stored credentials.
5. Attacker parses the JSON response to locate service account tokens, database passwords, or TLS keys.
6. Attacker exfiltrates extracted credentials to external infrastructure for further exploitation.
7. Attacker utilizes stolen credentials to escalate privileges or gain persistent access to secondary systems.

Impact

Successful exploitation of this technique leads to the unauthorized access of sensitive environment secrets, such as API keys, database credentials, and service account tokens. This compromise often results in lateral movement, data exfiltration, or the total takeover of the cluster. Depending on the secrets exposed, the impact ranges from application-level breaches to full control of cloud infrastructure environments.

Recommendation

Deploy the detection logic to your SIEM/XDR platform and audit all alerts generated by non-authorized entities.

• Enable Kubernetes audit logging and ensure logs-kubernetes.audit_logs-* is populated in your centralized log management.
• Review the list of excluded service accounts in the provided rule and verify they align with the current service accounts operating within your specific cluster.
• Implement strict RBAC policies (Principle of Least Privilege) for all pods and users to ensure only required entities have the 'list' permission for the 'secrets' resource.