Cross-source coverage

T1552.007 / ATT&CK

Unsecured Credentials: Container API

36 rules across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.

An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment. An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.

Platforms
Containers
Telemetry
docker:apikubernetes:apiserverkubernetes:orchestrator

How MITRE says to detect it DET0198

Detect Abuse of Container APIs for Credential Access

Containers Analytic 0571

Detection correlates anomalous Docker or Kubernetes API requests with access to logs, secrets, or service accounts. Observes unauthorized use of `docker logs`, `kubectl get secrets`, or direct API calls to Kubernetes API server endpoints. Identifies behavioral patterns where adversaries escalate from basic pod/container interaction to privileged API calls exposing sensitive credential material.

  • docker:api docker logs access or container inspect commands from non-administrative users
  • kubernetes:apiserver get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts
  • kubernetes:apiserver exec into pod followed by secret retrieval via API
  • kubernetes:orchestrator Access to orchestrator logs containing credentials (Docker/Kubernetes logs)

View on attack.mitre.org ↗

elastic/detection-rules

21 rules
Detection Severity Format
Azure AKS Secret get or list with Suspicious User Agent High Elastic TOML
GKE Pod Exec Sensitive File or Credential Path Access High Elastic TOML
GKE Rapid Secret GET Activity Against Multiple Objects High Elastic TOML
GKE Secret get or list with Suspicious User Agent High Elastic TOML
GKE Secrets List from Unusual Source AS Organization High Elastic TOML
Kubernetes Pod Exec Sensitive File or Credential Path Access High Elastic TOML
Kubernetes Rapid Secret GET Activity Against Multiple Objects High Elastic TOML
Kubernetes Secret get or list with Suspicious User Agent High Elastic TOML
Kubernetes Secrets List Across Cluster or Sensitive Namespaces High Elastic TOML
Sensitive Identity File Open by Suspicious Process via Auditd High Elastic TOML

+ 11 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

4 rules
Detection Severity Format
Azure Kubernetes Admission Controller Medium Sigma
Google Cloud Kubernetes Admission Controller Medium Sigma
Kubernetes Admission Controller Modification Medium Sigma
Kubernetes Secrets Enumeration Low Sigma

panther-labs/panther-analysis

4 rules
Detection Severity Format
Kubernetes All Secrets Dumped Across Namespaces Critical Panther Python
Kubernetes Service Account Token Theft from Pod High Panther Python
Kubernetes Secret Access Denied Medium Panther Python
Kubernetes Secret Enumeration by a User Medium Panther Python

splunk/security_content

4 rules
Detection Severity Format
Kubernetes Abuse of Secret by Unusual Location Undefined SPL
Kubernetes Abuse of Secret by Unusual User Agent Undefined SPL
Kubernetes Abuse of Secret by Unusual User Group Undefined SPL
Kubernetes Abuse of Secret by Unusual User Name Undefined SPL

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Kubernetes: Attempt to read service account token via exec (T1552.007) High Wazuh XML
Kubernetes: List all secrets from all namespaces (T1552.007) High Wazuh XML
Kubernetes: List secrets from a specific namespace (T1552.007) Medium Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.