Sample rules
Azure AKS Secret get or list with Suspicious User Agent
- source: elastic
- technicques:
- T1552
Description
Detects successful AKS (Azure Kubernetes Service) secret get or list operations where the user agent matches scripting runtimes (python, ruby, perl), command-line HTTP clients (curl, wget, HTTPie), or generic HTTP libraries (Go-http-client, okhttp, Apache-HttpClient, Guzzle, axios, undici) rather than typical kubectl or named controller traffic. Reading Kubernetes secrets with a generic client is a common credential-access step after a token or kubeconfig is stolen, and offensive tooling (for example peirates and kdigger) frequently reaches the API with a default Go HTTP client.
Detection logic
data_stream.dataset:azure.platformlogs and
event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
azure.platformlogs.category:"kube-audit" and
azure.platformlogs.properties.log.responseStatus.code:("200" or "201") and
azure.platformlogs.properties.log.verb:("get" or "list") and
azure.platformlogs.properties.log.objectRef.resource:"secrets" and
azure.platformlogs.properties.log.userAgent:(
curl* or python* or Python* or wget* or Wget* or Go-http* or perl* or libwww-perl* or
java* or Java* or node* or php* or Guzzle* or Bun* or axios* or undici* or okhttp* or
Apache-HttpClient* or HTTPie* or Ruby* or PostmanRuntime* or RestSharp* or *distrib#kali* or *kali-amd64* or *kali-arm64*
)
GKE Secret get or list with Suspicious User Agent
- source: elastic
- technicques:
- T1552
Description
Detects successful GKE secret get or list operations where the user agent matches scripting runtimes, minimal HTTP clients, or offensive-distribution fingerprints rather than typical kubectl or controller traffic.
Detection logic
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:("io.k8s.core.v1.secrets.list" or "io.k8s.core.v1.secrets.get") and user_agent.original:(
curl* or python* or Python* or wget* or Go-http* or perl* or java* or node* or php* or *distrib#kali* or *kali-amd64* or
*kali-arm64* or Bun* or axios* or undici*
)