Sigma rule: Kubernetes Potential Enumeration Activity

Rule

Title

Kubernetes Potential Enumeration Activity

Status

experimental

Level

medium

Author

uniqu3-us3r

Date

2026-04-28

File

rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.

Log source

product

kubernetes

service

audit

Detection

selection_status:
    responseStatus.code: 'ALLOW'
selection_request_uri:
    requestURI|contains:
        # Shells Encoded
        - '%2fbin%2fash'
        - '%2fbin%2fbash'
        - '%2fbin%2fbusybox'
        - '%2fbin%2fdash'
        - '%2fbin%2fsh'
        - '%2fbin%2fzsh'
        # Shells Plain
        - '/bin/ash'
        - '/bin/bash'
        - '/bin/busybox'
        - '/bin/dash'
        - '/bin/sh'
        - '/bin/zsh'
        # Tools Encoded
        - '%2fusr%2fbin%2fcurl'
        - '%2fusr%2fbin%2fkubectl'
        - '%2fusr%2fbin%2fperl'
        - '%2fusr%2fbin%2fpython'
        - '%2fusr%2fbin%2fwget'
        # Tools Plain
        - '/usr/bin/curl'
        - '/usr/bin/kubectl'
        - '/usr/bin/perl'
        - '/usr/bin/python'
        - '/usr/bin/wget'
selection_request_user_agent:
    userAgent|contains:
        - 'access_matrix'  # Rakkess
        - 'trufflehog'     # Secret scanning tool
        - 'azurehound'     # Azure/Cloud discovery
        - 'micro-scanner'  # Vulnerability scanning
condition: selection_status and 1 of selection_request_*

False positives (as the rule lists them)

• Authorized administrative maintenance via kubectl
• Automated internal infrastructure monitoring and certificate rotation
• Security-approved vulnerability or secret scanning in DevSecOps pipelines

Tags

• attack.execution
• attack.discovery
• attack.t1609
• attack.t1613

MITRE ATT&CK ids this rule names

• T1609
• T1613

References

• https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
• https://github.com/trufflesecurity/trufflehog
• https://github.com/corneliusweig/rakkess

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml