This rule detects suspicious AKS (Azure Kubernetes Service) secret read activity by targeting successful get/list operations against Kubernetes secrets where the user agent woodwork resembles scripting runtimes or generic HTTP clients rather than kubectl or controller traffic. It watches AKS audit events delivered via the azure.platformlogs stream, specifically event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read with verb: get or list and objectRef.resource: secrets, within the kube-audit category, and requires a 200/201 response. The intended signal is a possible credential-access attempt where an attacker, after stealing a token or kubeconfig, uses a non-standard HTTP client (curl, wget, HTTPie, Python/Ruby/Go-http-client, okhttp, Apache-HttpClient, Guzzle, axios, undici, etc.) to read secrets. User agents can be spoofed, so this rule serves as corroborating evidence rather than definitive proof and should be correlated with identity, authorization decisions, and source IPs. The rule emphasizes that normal automation may legitimately use generic HTTP clients, and exceptions should be applied to trusted service accounts after review. Sensitivity is high due to potential exposure of secrets; the rule is designed to prompt investigation into the acting identity, authorization decision, the exact secret read, and related RBAC and token lifecycle processes, followed by remediation if unauthorized.