Access to Kubernetes configuration file

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2025-02-14

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Kubernetes - AGENT
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Informational

A process accessed a Kubernetes node configuration file.

Gain access to the Kubernetes environment.

Look for additional suspicious activities.
Verify if the exposed credentials were used to access the API server.
Investigate which operations were used against the Kubernetes cluster with the exposed credentials.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Low

A process accessed a Kubernetes node configuration file.

Gain access to the Kubernetes environment.

Look for additional suspicious activities.
Verify if the exposed credentials were used to access the API server.
Investigate which operations were used against the Kubernetes cluster with the exposed credentials.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Low

A process accessed a Kubernetes node configuration file.

Gain access to the Kubernetes environment.

Look for additional suspicious activities.
Verify if the exposed credentials were used to access the API server.
Investigate which operations were used against the Kubernetes cluster with the exposed credentials.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Informational

A process accessed a Kubernetes node configuration file.

Gain access to the Kubernetes environment.

Look for additional suspicious activities.
Verify if the exposed credentials were used to access the API server.
Investigate which operations were used against the Kubernetes cluster with the exposed credentials.