Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Kubernetes Sensitive Configuration File Activity

This rule detects the creation or modification of sensitive Kubernetes configuration files on Linux systems. These files include Kubernetes manifests, PKI files, and configuration files that are critical for the operation of Kubernetes clusters. Monitoring these files helps identify potential unauthorized changes or misconfigurations that could lead to security vulnerabilities in Kubernetes environments. Attackers may attempt to modify these files to gain persistence or to deploy malicious containers within the Kubernetes cluster.

ATT&CK coverage

Execution

Persistence

T1543Create or Modify System ProcessAlso under Privilege Escalation.103 detections cover this technique
- T1543.005Container Service 2 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

Tagged by the source as

Data Source: Elastic DefendData Source: Elastic Defend for ContainersDomain: ContainerDomain: EndpointDomain: KubernetesOS: LinuxResources: Investigation GuideTactic: PersistenceUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.