Kubernetes Broad Secret Dumping via Kubectl

Brandon Rodriguez@BMRodriguez

•updated Mar 25, 2026•2•1•116

Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.