Azure Kubernetes Secret or Config Object Access

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•36

Identifies when a Kubernetes account accesses sensitive objects such as ConfigMaps or Secrets within Azure Kubernetes Service. This rule specifically looks for write or delete operations on these objects, which could indicate unauthorized access or malicious activity.