id: kubernetes-dockercfg-secret

info:
  name: kubernetes.io/dockercfg Secret
  author: dwisiswant0
  severity: info
  reference:
    - https://blog.aquasec.com/the-ticking-supply-chain-attack-bomb-of-exposed-kubernetes-secrets
  metadata:
    verified: true
  tags: kubernetes,k8s,file,keys,secret

file:
  - extensions:
      - yaml
      - yml

    extractors:
      - type: regex
        part: body
        regex:
          - \.dockercfg:\s+["']?e(w|y)[\w=]+["']?
# digest: 490a00463044022051e63ac3ef2ab928c06d6228e319940ab7e71c1d2bc6c15eef2b1a0c28c5021102203c4493859970ff1a6ed4def0d82c8b4f56fd1e41c8521951b878225c64b0979f:922c64590222798bb761d5b6d8e72950