Topics
Topics
Reference materials covering offensive and defensive Kubernetes security techniques
33 Total
21 ATT&CK mapped
21 Offensive
12 Defensive
OFFENSIVE LATERAL MOVEMENT
Abusing Kubernetes API Server Proxy Bypassing network policies and accessing internal services through the Kubernetes API server proxy subresource OFFENSIVE PRIVILEGE ESCALATION
Abusing Kyverno MutatingPolicy How MutatingPolicy access can be abused to change pods during admission in Kyverno OFFENSIVE RECONNAISSANCE
Active Internal Network Reconnaissance Scanning internal cluster IP ranges from a compromised pod to discover open ports on services, pods, and nodes OFFENSIVE RECONNAISSANCE
Cluster Reconnaissance via Prometheus Querying an unauthenticated Prometheus endpoint to map cluster topology without touching the Kubernetes API OFFENSIVE PRIVILEGE ESCALATION
Compromising ArgoCD via Application Sync Steering an Application destination into the argocd namespace so the controller overwrites argocd-rbac-cm and the submitter becomes an ArgoCD admin OFFENSIVE CREDENTIAL ACCESS
Compromising etcd via Pod Creation Steal etcd TLS via pod hostPath on the control plane OFFENSIVE EXFILTRATION
Data Exfiltration via Kubernetes Events How attackers can misuse Kubernetes Events to move data out after cluster compromise DEFENSIVE
Detecting API Server Proxy Abuse Identifying abuse of the services/proxy and pods/proxy subresources to bypass network segmentation or use the API server as an open HTTP proxy DEFENSIVE
Detecting Argo Workflows Abuse via Audit Logs Identifying unauthorized workflow creation, CronWorkflow persistence, and WorkflowTemplate poisoning by auditing argoproj.io resource events DEFENSIVE
Detecting Data Exfiltration via Kubernetes Events Identifying abuse of the Kubernetes Events API to smuggle data out of a cluster through event message fields DEFENSIVE
Detecting Impersonation Abuse Identifying impersonation abuse by inspecting the impersonatedUser audit field and reviewing which subjects hold the impersonate verb DEFENSIVE
Detecting kubectl debug Activity via Audit Logs Identifying ephemeral container injection and node debug pod creation through API server audit events DEFENSIVE
Detecting Orphan Pod Masquerading via Audit Logs Identifying pods that mimic controller-managed naming patterns but were created directly by a user rather than a controller DEFENSIVE
Detecting Permission Enumeration via Audit Logs Spotting enumeration of current RBAC access by auditing SelfSubjectRulesReview events DEFENSIVE
Disable Automatic Mounting of Default Service Account Tokens Preventing token theft by controlling service account token mounting DEFENSIVE
Enforcing Read-Only Container Filesystems Prevent attackers from writing tools, backdoors, or scripts to a container's filesystem after gaining code execution OFFENSIVE RECONNAISSANCE
GKE Anonymous Reconnaissance Exposing GKE patch versions and cluster configuration to unauthenticated clients when anonymousAuthenticationConfig is ENABLED DEFENSIVE
Hiding Services from Enumeration Preventing internal service discovery by disabling automatic injection of service environment variables OFFENSIVE RECONNAISSANCE
Internal Cluster Discovery Techniques for discovering available services, APIs, and potential attack vectors within a Kubernetes cluster OFFENSIVE PRIVILEGE ESCALATION
Kubernetes Impersonation Abusing the impersonate verb and Impersonate-* headers so the API server authorizes requests as another user, group, or ServiceAccount OFFENSIVE DEFENSE EVASION
Orphan Pod Masquerading Creating orphan pods that mimic controller-managed naming conventions to blend in with legitimate workloads OFFENSIVE RECONNAISSANCE
Passive Secret Discovery via kube-state-metrics Passively discovering secret names, namespaces, and metadata cluster-wide by querying the unauthenticated kube-state-metrics endpoint OFFENSIVE PERSISTENCE
Persistence via Unbound Service Account Tokens Using unbound tokens from the TokenRequest API to maintain cluster access after deleting the attacking pod OFFENSIVE PRIVILEGE ESCALATION
Privilege Escalation via serviceaccounts/token Permission How create permission on the serviceaccounts/token subresource enables acquiring tokens for more privileged service accounts without pods or Secrets DEFENSIVE
Restricting Prometheus Endpoint Access Preventing unauthenticated access to Prometheus metrics that expose cluster topology, pod identities, and internal service addresses OFFENSIVE PERSISTENCE
Rogue Static Pod Deployment Deploying static pod manifests that bypass API server admission to run containers invisible to kubectl and API-based monitoring OFFENSIVE CREDENTIAL ACCESS
Secret Exfiltration via ApplicationSet Generators Abusing tokenRef on a pullRequest generator to make the controller send a Secret from the argocd namespace to a URL you control DEFENSIVE
Securing ArgoCD Application Access Restrict ArgoCD RBAC, enforce AppProject boundaries, and block privileged workload deployment through the ArgoCD confused deputy attack path OFFENSIVE CREDENTIAL ACCESS
ServiceAccount Token Theft Techniques for obtaining ServiceAccount tokens using legitimate Kubernetes features without exploiting vulnerabilities OFFENSIVE PRIVILEGE ESCALATION
Weaponizing Argo Workflows Abusing Argo Workflows API to execute arbitrary workloads for privilege escalation and persistence OFFENSIVE PRIVILEGE ESCALATION
Weaponizing ArgoCD Application Abusing ArgoCD as a confused deputy to deploy disguised privileged workloads cluster-wide and maintain persistent access OFFENSIVE PRIVILEGE ESCALATION
Weaponizing kubectl debug Why kubectl debug is a privilege escalation path, not just a troubleshooting tool OFFENSIVE PRIVILEGE ESCALATION
Weaponizing Pod Creation Access How pod creation permissions can be leveraged to escalate privileges and escape to the underlying node No topics found matching your filters.
Try another keyword, or clear filters to see everything again.