Kubectl

Adversaries may attempt to evade detection by renaming the kubectl binary or executing it from non-standard directories while retaining command-line functionality to perform unauthorized Kubernetes operations.

Adversaries may perform unauthorized impersonation within Kubernetes clusters by executing the 'kubectl' command-line tool with sensitive flags like '--as' or '--token' to escalate privileges or bypass access controls.

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

This rule detects command-line activity indicative of credential access across multiple cloud platforms (GCP, Azure, AWS, GitHub, DigitalOcean, Oracle, Kubernetes), looking for specific commands used to print or access tokens and credentials, flagging hosts where multiple cloud targets are accessed within a five-minute window, suggesting potential credential harvesting activity.