Elastic Security Detection Rules

AWS EKS Secrets List Across Cluster or Sensitive Namespaces

Last updated 3 days ago on 2026-10-20
Created 3 months ago on 2026-08-03

About

Detects list operations on Kubernetes Secrets from a non-loopback client when the request URI targets cluster-wide secrets or list operations under kube-system or default. Useful for spotting broad secret enumeration from remote clients.
Tags
Domain: CloudDomain: ContainersPlatform: AWSPlatform: KubernetesData Source: AWSData Source: Amazon Web ServicesData Source: Kubernetes API Server Audit LogsService: AWS EKSUse Case: Threat DetectionTactic: Credential AccessTactic: DiscoveryRule Type: Custom Query (KQL)Profile: BetaLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Unsecured Credentials (T1552)(external, opens in a new tab or window)

Discovery (TA0007)(external, opens in a new tab or window)

↳ Container and Resource Discovery (T1613)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.eks_audit-*
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:"aws.eks_audit" and event.action:list and
aws.eks.audit.objectRef.resource:secrets and
aws.eks.audit.requestURI :(/api/v1/secrets or /api/v1/secrets?limit* or /api/v1/namespaces/kube-system/secrets or /api/v1/namespaces/kube-system/secrets?limit* or /api/v1/namespaces/default/secrets or /api/v1/namespaces/default/secrets?limit*) and
source.ip:(* and not ("::1" or "127.0.0.1")) and
not user.name: (system\:kube-controller-manager or eks\:cloud-controller-manager or eks\:kms-storage-migrator or
  "system:serviceaccount:argocd:argocd-application-controller" or
  "system:serviceaccount:elastic:kube-state-metrics" or
  "system:serviceaccount:cert-manager:cert-manager-cainjector" or
  "system:serviceaccount:elastic-system:elastic-agent" or
  "system:serviceaccount:longhorn-system:longhorn-service-account") and
not aws.eks.audit.user.groups:("system:serviceaccounts:ibm-csi" or "system:serviceaccounts:argocd" or "system:serviceaccounts:elastic")

Install detection rules in Elastic Security

Detect AWS EKS Secrets List Across Cluster or Sensitive Namespaces in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).