id: kubernetes-dockerconfigjson-secret

info:
  name: kubernetes.io/dockerconfigjson Secret
  author: dwisiswant0
  severity: info
  reference:
    - https://blog.aquasec.com/the-ticking-supply-chain-attack-bomb-of-exposed-kubernetes-secrets
  metadata:
    verified: true
  tags: kubernetes,k8s,file,keys,secret

file:
  - extensions:
      - yaml
      - yml

    extractors:
      - type: regex
        part: body
        regex:
          - \.dockerconfigjson:\s+["']?e(w|y)[\w=]+["']?
# digest: 4a0a00473045022100d64fc9df409a71b562f66e152b4b4eba04c62673dbcf2441012df16e92ff18c8022045ffa429db9c5f666a61db9744f3854467c2ac9eddfb7fc7f90a17f466c7a5bd:922c64590222798bb761d5b6d8e72950