TeamPCP - Kubernetes All-Namespace Secret Harvest (T1613)
Identifies kubectl executed from the Python payload dumping secrets across all available cluster namespaces.
Microsoft Sentinel (KQL)

Identifies kubectl executed from the Python payload dumping secrets across all available cluster namespaces.

Already have an account?