Kubernetes ServiceAccount Suspicious Discovery

Daniel Jeremiah@daniyyell

•updated Jun 1, 2026•4•0•10

Detects ServiceAccount-based enumeration of sensitive Kubernetes resources. This rule identifies when a Kubernetes ServiceAccount performs a high volume of 'get', 'list', or 'watch' operations on sensitive resources such as secrets, pods, nodes, namespaces, or other role-related resources. It specifically flags activity with 'secrets' as high severity.