| elastic |
AWS EKS Secret get or list from Node or Pod Service Account |
production |
2026-10-20 |
| elastic |
AWS EKS Service Account Token Created via TokenRequest API |
production |
2026-10-20 |
| elastic |
AWS EKS Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-10-20 |
| elastic |
AWS EKS Rapid Secret GET Activity Against Multiple Objects |
production |
2026-10-20 |
| elastic |
AWS EKS Secret get or list with Suspicious User Agent |
production |
2026-10-20 |
| elastic |
AWS EKS Pod Exec Sensitive File or Credential Path Access |
production |
2026-10-20 |
| elastic |
Kubernetes Service Account Token Created via TokenRequest API |
production |
2026-10-06 |
| elastic |
GKE Unusual Service Account Secret Access via New User Agent |
deprecated |
2026-09-29 |
| elastic |
Kubernetes Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-22 |
| elastic |
GKE Secrets List from Unusual Source AS Organization |
production |
2026-09-18 |
| elastic |
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Rapid Secret GET Activity Against Multiple Objects |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Get or List with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Get or List from Node or Pod Service Account |
production |
2026-09-18 |
| elastic |
Kubernetes Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-09-18 |
| elastic |
Sensitive Identity File Open by Suspicious Process via Auditd |
production |
2026-09-18 |
| elastic |
GKE Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Direct API Request via Curl or Wget |
production |
2026-09-18 |
| elastic |
Azure AKS Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access |
production |
2026-09-18 |
| elastic |
Azure Arc Cluster Credential Access by Identity from Unusual Source |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-18 |
| elastic |
GKE Rapid Secret GET Activity Against Multiple Objects |
production |
2026-09-18 |
| elastic |
GKE Secret Access from Node or Denied Service Account |
production |
2026-09-18 |
| elastic |
GKE Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
GKE Service Account Token Created via TokenRequest API |
deprecated |
2026-08-21 |
| splunk |
Kubernetes Abuse of Secret by Unusual User Name |
production |
2026-05-13 |
| splunk |
Kubernetes Abuse of Secret by Unusual User Group |
production |
2026-05-13 |
| splunk |
Kubernetes Abuse of Secret by Unusual User Agent |
production |
2026-05-13 |
| splunk |
Kubernetes Abuse of Secret by Unusual Location |
production |
2026-05-13 |
| sigma |
Kubernetes Admission Controller Modification |
test |
2024-07-11 |
| sigma |
Kubernetes Secrets Enumeration |
test |
2024-03-26 |
| sigma |
Google Cloud Kubernetes Admission Controller |
test |
2022-12-18 |
| sigma |
Azure Kubernetes Admission Controller |
test |
2022-12-18 |