This rule detects Kubernetes audit events in the AWS EKS audit stream (aws.eks_audit) where the requester identity is a node (system:node:<nodename>) or a pod service account (system:serviceaccount:<namespace>:<name>) performing read-style actions (get or list) on the secrets resource. Reading secrets in this context can indicate credential access attempts, such as enumerating tokens, registry credentials, TLS keys, or app configuration. Because legitimate controllers (e.g., cert-manager, external-secrets, sealed-secrets), CSI drivers, and certain operators may legitimately read secrets, the alert is most effective when paired with triage data such as the namespace scope, user agent, RBAC, and whether the specific secret names should be touched by that identity. Node-originated secret reads are high-priority, since kubelet processes should not broadly enumerate cluster secrets. For service accounts, cross-namespace access, access to high-value secret names, and unusual user agents should be treated as suspicious unless verified as part of normal workload patterns. Investigation guidance covers: - Map user.name (or aws.eks.audit.user.username if present) to the node or workload and review RBAC RoleBindings/ClusterRoleBindings for secret get/list scope. - Inspect aws.eks.audit.objectRef.namespace, aws.eks.audit.objectRef.name, source IP, and user_agent.original to separate known automation from anomalous activity. - Check aws.eks.audit.annotations.authorization_k8s_io/decision for reads vs denials. - Correlate with related activity (pod exec, token creation, RoleBinding changes, or secret modification) within the same window. False positives may arise from legitimate secret reconciliation (e.g., cert-manager, external-secrets, sealed-secrets) or deployment-time secret access by Helm/pipeline tooling. Consider allowlisting known service accounts and scoped namespaces after baselining. Remediation steps if malicious: - Revoke or rotate the involved token/credentials; isolate or cordon the affected host/workload; tighten RBAC to least privilege for the identity. - If in doubt, audit access patterns and review the specific secret names touched to determine necessity and exposure. Threat context: MITRE ATT&CK - Credential Access (T1552; Container API T1552.007). The rule uses the AWS EKS audit data stream to surface potential attempts to access sensitive material via Kubernetes API on secrets, helping detect post-intrusion reconnaissance or early credential theft.