Kubernetes Secret Object Accessed via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to access Kubernetes secret objects via the Kubernetes API. It specifically looks for HTTP requests to the '/api/v1/namespaces/' path followed by '/secrets' on port 8080. This activity could indicate an attacker attempting to exfiltrate sensitive information stored in Kubernetes secrets.