LoFP / the kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret

Techniques

• t1552
• t1552.007

Sample rules

Kubernetes Secrets Enumeration

• source: sigma
• technicques:
  • t1552
  • t1552.007

Description

Detects enumeration of Kubernetes secrets.

Detection logic

condition: selection
selection:
  objectRef.resource: secrets
  verb: list