Kubernetes Recon: Secret/ConfigMap Enumeration & Privileged Pod Deploy

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects reconnaissance and lateral movement activity via kubectl. The rule monitors for the enumeration of Kubernetes secrets or configmaps, and the deployment or application of privileged workloads featuring flags such as hostPath mounts, privileged execution, hostNetwork, or hostPID.