TeamPCP Trivy Supply Chain - Kubernetes Secrets Exfiltration

Lacey Cochrane@NullVectorX

•updated Mar 27, 2026•7•0•192

Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.