Kubernetes API Access to Secrets Endpoint

nomit vyas@xoxo

•updated Jun 24, 2026•2•0•10

This rule detects network events where a device attempts to access the Kubernetes API '/api/v1/namespaces/*/secrets' endpoint. This activity could indicate an attempt to enumerate or exfiltrate sensitive information (secrets) stored within Kubernetes, potentially by an attacker who has gained initial access to a pod or compromised a service account.