Kubernetes Secrets Modified or Deleted
Detects when Kubernetes Secrets are Modified or Deleted.
Detection logic
Detection requirements
- Log source product
- kubernetes
- Log source service
- audit
Known benign triggers
- Automated processes may need to take these actions and may need to be filtered.
- Secrets being modified or deleted may be performed by a system administrator.
MITRE ATT&CK mappings
Not mapped to ATT&CK.
References
| Reference | Cited by |
|---|---|
| commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ | Only this detection cites it |
| kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ | 5 |
From the source
- At source
- Open at source
- Upstream identifier
- 58d31a75-a4f8-4c40-985b-373d58162ca2
- Tagged by the source as
- attack.credential-access
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 26, 2026
- Version
- 1