Kubernetes Service Account Token Theft via Web Utilities
Detects attempts to access or exfiltrate the default Kubernetes service account token file using web utilities like curl or wget. This activity is commonly observed in attacks by threat actors such as Slow Pisces to escalate privileges or move laterally from a compromised pod into backend cloud infrastructure.
Sigma
