Kubernetes Secret Enumeration By Non Admin Identity

Query

let Lookback = 1d;
let AllowedAdminUsers = dynamic([
	"system:serviceaccount:flux-system:kustomize-controller",
	"system:serviceaccount:argocd:argocd-application-controller"
]);
// Secret enumeration by non-admin identity
CloudAuditEvents
| where Timestamp > ago(Lookback)
| where DataSource =~ "Kubernetes Audit"
| extend Verb = tolower(coalesce(tostring(RawEventData.verb), OperationName))
| extend Resource = tolower(tostring(RawEventData.objectRef.resource))
| where Resource == "secrets"
| where Verb in ("get", "list", "watch")
| extend Namespace = tostring(RawEventData.objectRef.namespace), SecretName = tostring(RawEventData.objectRef.name)
| extend User = tostring(RawEventData.user.username), SourceIp = tostring(RawEventData.sourceIPs[0])
| where User !in (AllowedAdminUsers)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), SecretCount=dcount(SecretName), Namespaces=dcount(Namespace), Secrets=make_set(SecretName, 20), UserAgents=make_set(UserAgent, 5) by User, SourceIp
| where SecretCount >= 5 or Namespaces >= 2
| project FirstSeen, LastSeen, Detection="K8S secret enumeration", User, SourceIp, SecretCount, Namespaces, Secrets, UserAgents

About this query

Kubernetes Secret Enumeration by Non-Admin Identity

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1087	Account Discovery	https://attack.mitre.org/techniques/T1087
T1552.007	Container API	https://attack.mitre.org/techniques/T1552/007

Description

Detects anomalous Kubernetes API activity where a non-administrative user or service account accesses or lists multiple secret objects across different namespaces within a short timeframe. This behavior is indicative of an attacker attempting to discover sensitive credentials stored within the cluster.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect suspicious activity in a Kubernetes environment, specifically focusing on non-administrative users or service accounts accessing or listing multiple secret objects. Here's a simplified breakdown of what the query does:

Timeframe: It looks at Kubernetes audit logs from the past day (Lookback = 1d).
Admin Users: It defines a list of allowed administrative users or service accounts that are permitted to access secrets without raising an alert.
Event Filtering: The query filters events from the Kubernetes audit logs where the action involves accessing secrets (get, list, or watch actions on the "secrets" resource).
User Filtering: It excludes events performed by the allowed admin users, focusing on actions by other users.
Suspicious Activity Detection: It identifies users who have accessed or listed secrets in multiple namespaces or accessed a significant number of secrets (5 or more) within the specified timeframe.
Result Summarization: For each suspicious user, it summarizes the activity by showing the first and last time the activity was seen, the number of secrets accessed, the number of different namespaces involved, and lists the secrets and user agents involved.
Output: The final output includes details such as the time of detection, the user involved, their IP address, and the extent of their secret enumeration activity.

Overall, this query helps identify potential unauthorized attempts to discover sensitive information stored in Kubernetes secrets by non-admin users.