* [New] Kubernetes Secret get or list via Scripting or Generic HTTP Client
After obtaining Kubernetes API credentials, adversaries often reach for generic HTTP stacks and scripting runtimes (curl, wget, Python requests, Go’s default client, and similar) instead of kubectl or in-cluster controllers that advertise purpose-built user agents. Those clients are easy to drive from a stolen kubeconfig, a compromised bastion, or a reverse shell and are commonly used to enumerate or download Secret objects (tokens, registry credentials, TLS material, application keys).
* ++
* Update credential_access_kubernetes_secret_access_scripting_http_clients.toml
Samirbous
0c69b63ff2