Topics

Reference materials covering offensive and defensive Kubernetes security techniques

Total

26

MITRE ATT&CK mapped

16

Offensive

16

Defensive

10

Latest topics

Filters the topic cards below as you type.

Showing 26 topics

View:

Browse topics

offensive Lateral Movement

Abusing Kubernetes API Server Proxy

Bypassing network policies and accessing internal services through the Kubernetes API server proxy subresource

offensive Privilege Escalation

Abusing Kyverno MutatingPolicy

How MutatingPolicy access can be abused to change pods during admission in Kyverno

offensive Reconnaissance

Cluster Reconnaissance via Prometheus

Querying an unauthenticated Prometheus endpoint to map cluster topology without touching the Kubernetes API

offensive Credential Access

Compromising etcd via Pod Creation

Steal etcd TLS via pod hostPath on the control plane

offensive Exfiltration

Data Exfiltration via Kubernetes Events

How attackers can misuse Kubernetes Events to move data out after cluster compromise

defensive

Detecting Data Exfiltration via Kubernetes Events

Identifying abuse of the Kubernetes Events API to smuggle data out of a cluster through event message fields

defensive

Detecting Impersonation Abuse

Identifying impersonation abuse by inspecting the impersonatedUser audit field and reviewing which subjects hold the impersonate verb

defensive

Detecting kubectl debug Activity via Audit Logs

Identifying ephemeral container injection and node debug pod creation through API server audit events

defensive

Detecting Orphan Pod Masquerading via Audit Logs

Identifying pods that mimic controller-managed naming patterns but were created directly by a user rather than a controller

defensive

Detecting Permission Enumeration via Audit Logs

Spotting enumeration of current RBAC access by auditing SelfSubjectRulesReview events

defensive

Disable Automatic Mounting of Default Service Account Tokens

Preventing token theft by controlling service account token mounting

defensive

Enforcing Read-Only Container Filesystems

Prevent attackers from writing tools, backdoors, or scripts to a container's filesystem after gaining code execution

defensive

Hiding Services from Enumeration

Preventing internal service discovery by disabling automatic injection of service environment variables

offensive Reconnaissance

Internal Cluster Discovery

Techniques for discovering available services, APIs, and potential attack vectors within a Kubernetes cluster

offensive Privilege Escalation

Kubernetes Impersonation

Abusing the impersonate verb and Impersonate-* headers so the API server authorizes requests as another user, group, or ServiceAccount

offensive Defense Evasion

Orphan Pod Masquerading

Creating orphan pods that mimic controller-managed naming conventions to blend in with legitimate workloads

offensive Reconnaissance

Passive Secret Discovery via kube-state-metrics

Passively discovering secret names, namespaces, and metadata cluster-wide by querying the unauthenticated kube-state-metrics endpoint

offensive Persistence

Persistence via Unbound Service Account Tokens

Using unbound tokens from the TokenRequest API to maintain cluster access after deleting the attacking pod

offensive Privilege Escalation

Privilege Escalation via serviceaccounts/token Permission

How create permission on the serviceaccounts/token subresource enables acquiring tokens for more privileged service accounts without pods or Secrets

defensive

Restricting Prometheus Endpoint Access

Preventing unauthenticated access to Prometheus metrics that expose cluster topology, pod identities, and internal service addresses

offensive Persistence

Rogue Static Pod Deployment

Deploying static pod manifests that bypass API server admission to run containers invisible to kubectl and API-based monitoring

defensive

Securing ArgoCD Application Access

Restrict ArgoCD RBAC, enforce AppProject boundaries, and block privileged workload deployment through the ArgoCD confused deputy attack path

offensive Credential Access

ServiceAccount Token Theft

Techniques for obtaining ServiceAccount tokens using legitimate Kubernetes features without exploiting vulnerabilities

offensive Privilege Escalation

Weaponizing ArgoCD Application

Abusing ArgoCD as a confused deputy to deploy disguised privileged workloads cluster-wide and maintain persistent access

offensive Privilege Escalation

Weaponizing kubectl debug

Why kubectl debug is a privilege escalation path, not just a troubleshooting tool

offensive Privilege Escalation

Weaponizing Pod Creation Access

How pod creation permissions can be leveraged to escalate privileges and escape to the underlying node