Sigma rule: Azure Kubernetes Secret or Config Object Access

Rule

Title

Azure Kubernetes Secret or Config Object Access

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-08-07

Modified

2022-08-23

File

rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Log source

product

azure

service

activitylogs

Detection

selection:
    operationName:
        - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE
        - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE
        - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE
        - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE
condition: selection

False positives (as the rule lists them)

• Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.impact
• attack.t1485
• attack.t1496
• attack.t1489

MITRE ATT&CK ids this rule names

• T1485
• T1489
• T1496

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
• https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
• https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
• https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml