Kubernetes Secret Discovery via Kubectl

Adversaries targeting Kubernetes environments frequently attempt to discover sensitive information stored within the cluster. A common technique involves using the kubectl command-line utility to query for secret resources across the entire cluster using global flags. By executing kubectl get secrets --all-namespaces or the abbreviated kubectl get secrets -A, an attacker can gain visibility into secrets across multiple namespaces, even if their current context is restricted.

This activity is a high-signal indicator of unauthorized reconnaissance. Defenders must differentiate this activity from legitimate administrative, CI/CD, or compliance-related resource inventory. Because these secrets often contain API keys, database credentials, or TLS certificates, successful discovery is a critical precursor to further compromise, such as privilege escalation or exfiltration of sensitive application data. Defenders should focus on process-level command-line monitoring and correlate findings with Kubernetes API audit logs.

Impact

Successful secret discovery can lead to the exposure of highly sensitive credentials, enabling an attacker to escalate privileges within the cluster, move laterally to other pods or services, or exfiltrate data from external systems accessed via the discovered secrets. The damage depends on the sensitivity of the stored secrets; in worst-case scenarios, it provides the attacker with administrative control over the entire cluster or connected cloud infrastructure.

Recommendation

• Deploy the detection rule below to identify kubectl execution with broad secret discovery flags.
• Baseline existing administrative, CI/CD, and compliance tool execution patterns to reduce noise from authorized workflows.
• Enable Kubernetes API audit logging to correlate kubectl execution with specific secret read events.
• Review and tighten Role-Based Access Control (RBAC) permissions to ensure that service accounts and users operate under the principle of least privilege regarding namespace and resource visibility.
• If unauthorized discovery is detected, rotate any secrets that were accessible to the compromised identity and audit surrounding activity for signs of credential usage or persistence.