Kubernetes Suspicious Namespace & Node Operations (Management Plane)

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•6

Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.