K8s Service Account Token Exfiltration via Web Utilities (Falco)
Detects curl or wget accessing the default Kubernetes service account token path. Adapted from Unit 42 reporting on Slow Pisces and React2Shell (CVE-2025-55182) campaigns.
Sigma
Detects curl or wget accessing the default Kubernetes service account token path. Adapted from Unit 42 reporting on Slow Pisces and React2Shell (CVE-2025-55182) campaigns.
Already have an account?