AN0571
Analytic 0571
Containers
Detection correlates anomalous Docker or Kubernetes API requests with access to logs, secrets, or service accounts. Observes unauthorized use of `docker logs`, `kubectl get secrets`, or direct API calls to Kubernetes API server endpoints. Identifies behavioral patterns where adversaries escalate from basic pod/container interaction to privileged API calls exposing sensitive credential material.
docker:api
docker logs access or container inspect commands from non-administrative users
kubernetes:apiserver
get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts
kubernetes:apiserver
exec into pod followed by secret retrieval via API
kubernetes:orchestrator
Access to orchestrator logs containing credentials (Docker/Kubernetes logs)
[UserContext]
Tune to exclude known orchestrator admin service accounts or CI/CD pipelines that legitimately access secrets
[NamespaceScope]
Restrict detection to sensitive namespaces (e.g., kube-system, production apps)
[TimeWindow]
Adjust correlation timing between pod execution and subsequent API secret retrieval
[SourceIP]
Filter based on allowed internal API calls vs anomalous external or cross-cluster access