Kubernetes Namespace Enumeration via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•2•0•2

This rule detects attempts to enumerate Kubernetes namespaces by looking for HTTP requests to the '/api/v1/namespaces' endpoint on port 8080. This activity could indicate an attacker attempting to discover available namespaces within a Kubernetes cluster.