Kubernetes Secrets Enumeration via API Server

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•15

Detects attempts to list, read, create, update, or delete Kubernetes secrets through the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive credentials or manipulate application configurations.