Unsecured Credentials: Container API `T1552.007`

Tactic: Credential Access

Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution

Authoring guide

These 32 rules share fields, values, and exclusions.

Fields filtered most (48 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	15	`eq` 15	`gcp.audit`, `kubernetes.audit_logs`, `azure.activitylogs`, `auditd_manager.auditd`, `azure.platformlogs`
`EventType`	14	`eq` 8, `in` 7	`io.k8s.core.v1.secrets.get`, `io.k8s.core.v1.secrets.list`, `get`, `list`, `ProcessRollup2`
`src_ip`	8	`is_not_null` 8
`ServiceName`	7	`eq` 7	`k8s.io`
`event.outcome`	7	`eq` 7	`success`, `failure`
`kubernetes.audit.objectRef.resource`	7	`eq` 6, `in` 1	`secrets`, `configmaps`, `serviceaccounts`
`verb`	7	`eq` 6, `in` 1	`get`, `list`, `create`, `delete`, `patch`
`objectRef.resource`	6	`eq` 6	`secrets`, `mutatingwebhookconfigurations`, `validatingwebhookconfigurations`
`aws::userAgent`	5	`is_not_null` 3, `contains` 2, `starts_with` 2	`Bun`, `Go-http`, `Python`
`client.user.email`	4	`is_not_null` 2, `starts_with` 2	`system:serviceaccount:`, `system:node:`
`username`	4	`contains` 4	`serviceaccount`
`kubernetes.audit.verb`	3	`in` 2, `eq` 1	`create`, `get`, `delete`, `list`
`user`	3	`is_not_null` 2, `starts_with` 1	`system:node:`, `system:serviceaccount:`
`azure.activitylogs.operation_name`	2	`eq` 2	`microsoft.kubernetes/connectedclusters/listclusterusercre...`
`event.dataset`	2	`eq` 2	`kubernetes.audit_logs`

Top indicator values (261 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`ServiceName`	`eq`	`k8s.io` elasticGKE Pod Exec Sensitive File or Credential Path Access elasticGKE Rapid Secret GET Activity Against Multiple Objects elasticGKE Secret Access from Node or Denied Service Account elasticGKE Secret Access via Unusual User Agent elasticGKE Secret get or list with Suspicious User Agent elasticGKE Secrets List from Unusual Source AS Organization elasticGKE Unusual Service Account Secret Access via New User Agent	7	36
`data_stream.dataset`	`eq`	`gcp.audit` elasticGKE Pod Exec Sensitive File or Credential Path Access elasticGKE Rapid Secret GET Activity Against Multiple Objects elasticGKE Secret Access from Node or Denied Service Account elasticGKE Secret Access via Unusual User Agent elasticGKE Secret get or list with Suspicious User Agent elasticGKE Secrets List from Unusual Source AS Organization elasticGKE Unusual Service Account Secret Access via New User Agent	7	69
`data_stream.dataset`	`eq`	`kubernetes.audit_logs` elasticKubernetes Secret Access via Unusual User Agent elasticKubernetes Secret Get or List from Node or Pod Service Account elasticKubernetes Secret Get or List with Suspicious User Agent elasticKubernetes Service Account Token Created via TokenRequest API	4	34
`event.outcome`	`eq`	`success` elasticAzure Arc Cluster Credential Access by Identity from Unusual Source elasticAzure Service Principal Sign-In Followed by Arc Cluster Credential Access elasticGKE Pod Exec Sensitive File or Credential Path Access elasticGKE Secret get or list with Suspicious User Agent elasticGKE Unusual Service Account Secret Access via New User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	6	375
`kubernetes.audit.objectRef.resource`	`eq`	`secrets` elasticKubernetes Rapid Secret GET Activity Against Multiple Objects elasticKubernetes Secret Access via Unusual User Agent elasticKubernetes Secret Get or List from Node or Pod Service Account elasticKubernetes Secret Get or List with Suspicious User Agent elasticKubernetes Secrets List Across Cluster or Sensitive Namespaces	5	6
`objectRef.resource`	`eq`	`secrets` sigmaKubernetes Secrets Enumeration splunkKubernetes Abuse of Secret by Unusual Location splunkKubernetes Abuse of Secret by Unusual User Agent splunkKubernetes Abuse of Secret by Unusual User Group splunkKubernetes Abuse of Secret by Unusual User Name	5	6
`username`	`contains`	`serviceaccount` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	4	24
`verb`	`eq`	`get` splunkKubernetes Abuse of Secret by Unusual Location splunkKubernetes Abuse of Secret by Unusual User Agent splunkKubernetes Abuse of Secret by Unusual User Group splunkKubernetes Abuse of Secret by Unusual User Name	4	4
`EventType`	`eq`	`io.k8s.core.v1.secrets.get` elasticGKE Rapid Secret GET Activity Against Multiple Objects elasticGKE Secret Access from Node or Denied Service Account elasticGKE Unusual Service Account Secret Access via New User Agent	3	3
`EventType`	`in`	`io.k8s.core.v1.secrets.get` elasticGKE Secret Access from Node or Denied Service Account elasticGKE Secret Access via Unusual User Agent elasticGKE Secret get or list with Suspicious User Agent	3	3
`EventType`	`in`	`io.k8s.core.v1.secrets.list` elasticGKE Secret Access from Node or Denied Service Account elasticGKE Secret Access via Unusual User Agent elasticGKE Secret get or list with Suspicious User Agent	3	3
`EventType`	`in`	`get` elasticKubernetes Secret Get or List from Node or Pod Service Account elasticKubernetes Secret Get or List with Suspicious User Agent	2	3
`EventType`	`in`	`list` elasticKubernetes Secret Get or List from Node or Pod Service Account elasticKubernetes Secret Get or List with Suspicious User Agent	2	3
`aws::userAgent`	`contains`	`distrib#kali` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	3
`aws::userAgent`	`contains`	`kali-amd64` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	3
`aws::userAgent`	`contains`	`kali-arm64` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	3
`aws::userAgent`	`starts_with`	`Bun` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`Go-http` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`Python` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`axios` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	4
`aws::userAgent`	`starts_with`	`curl` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`java` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`node` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`perl` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`php` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`python` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`undici` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`aws::userAgent`	`starts_with`	`wget` elasticGKE Secret get or list with Suspicious User Agent elasticKubernetes Secret Get or List with Suspicious User Agent	2	2
`azure.activitylogs.operation_name`	`eq`	`microsoft.kubernetes/connectedclusters/listclusterusercredential/action` elasticAzure Arc Cluster Credential Access by Identity from Unusual Source elasticAzure Service Principal Sign-In Followed by Arc Cluster Credential Access	2	2
`client.user.email`	`starts_with`	`system:serviceaccount:` elasticGKE Secret Access from Node or Denied Service Account elasticGKE Unusual Service Account Secret Access via New User Agent	2	3

Exclusions (97 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`src_ip`	`in`	`127.0.0.1` elasticGKE Secret Access from Node or Denied Service Account elasticGKE Secret Access via Unusual User Agent elasticGKE Unusual Service Account Secret Access via New User Agent elasticKubernetes Secrets List Across Cluster or Sensitive Namespaces	4
`src_ip`	`in`	`::1` elasticGKE Secret Access from Node or Denied Service Account elasticGKE Secret Access via Unusual User Agent elasticGKE Unusual Service Account Secret Access via New User Agent elasticKubernetes Secrets List Across Cluster or Sensitive Namespaces	4
`username`	`in`	`aksService` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	4
`username`	`in`	`masterclient` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	4
`username`	`starts_with`	`system:` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Secret Access Denied pantherKubernetes Secret Enumeration by a User pantherKubernetes Service Account Token Theft from Pod	4
`aws::userAgent`	`contains`	`kubernetes/$format` elasticGKE Secret Access via Unusual User Agent elasticGKE Unusual Service Account Secret Access via New User Agent	2
`namespace`	`in`	`gke-system` pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	2
`namespace`	`in`	`kube-node-lease` pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	2
`namespace`	`in`	`kube-public` pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	2
`namespace`	`in`	`kube-system` pantherKubernetes Secret Access Denied pantherKubernetes Service Account Token Theft from Pod	2
`resource`	`ne`	`secrets` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Secret Access Denied	2
`responseStatus.code`	`ge`	`1` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Service Account Token Theft from Pod	2
`responseStatus.code`	`ge`	`400` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Service Account Token Theft from Pod	2
`responseStatus.code`	`le`	`16` pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Service Account Token Theft from Pod	2
`user`	`in`	`system:kube-controller-manager` elasticKubernetes Rapid Secret GET Activity Against Multiple Objects elasticKubernetes Secrets List Across Cluster or Sensitive Namespaces	2

Unsecured Credentials: Container API `T1552.007`

Events covered

Authoring guide

Fields filtered most (48 distinct)

Top indicator values (261 distinct)

Exclusions (97 distinct)

Rules under this technique

Sigma 4 rules

Elastic 20 rules

Splunk 4 rules

Panther 4 rules

Unsecured Credentials: Container API T1552.007

Events covered

Authoring guide

Fields filtered most (48 distinct)

Top indicator values (261 distinct)

Exclusions (97 distinct)

Rules under this technique

Sigma 4 rules

Elastic 20 rules

Splunk 4 rules

Panther 4 rules

Unsecured Credentials: Container API `T1552.007`