The Kubenomicon

Матрица угроз в стиле MITRE ATTACK для Kubernetes, ориентированная на наступательную безопасность. С акцентом на то, как использовать каждую атаку.

1. Initial access
— Using cloud credentials
— Compromised image In registry
— Kubeconfig file
— Application vulnerability
— Exposed sensitive interfaces
— SSH server running inside container

2. Execution
— Exec inside container
— New container
— Application exploit (RCE)
— Sidecar injection

3. Persistence
— Backdoor container
— Writable hostPath mount
— Kubernetes cronjob
— Malicious admission controller
— Container service account
— Static pods

4. Privilege escalation
— Privileged container
— Cluster-admin binding
— hostPath mount
— Access cloud resources

5. Defense evasion
— Clear container logs
— Delete events
— Pod name similarity
— Connect from proxy server

6. Credential access
— List K8S secrets
— Access node information
— Container service account
— Application credentials in configuration files
— Access managed identity credentials
— Malicious admission controller

7. Discovery
— Access Kubernetes API server
— Access Kubelet API
— Network mapping
— Exposed sensitive interfaces
— Instance Metadata API

8. Lateral movement
— Access cloud resources
— Container service account
— Cluster internal networking
— Application credentials in configuration files
— Writable hostPath mount
— CoreDNS poisoning
— ARP poisoning and IP spoofing

9. Collection
— Images from a private registry
— Collecting data from pod