MITRE ATT&CK
📝 TL ; DR
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Impact |
|---|---|---|---|---|---|---|---|---|---|
| Using Cloud credentials | Exec into container | Backdoor container | Privileged container | Clear container logs | List K8S secrets | Access the K8S API server | Access cloud resources | Images from a private registry | Data Destruction |
| Compromised images in registry | bash/cmd inside container | Writable hostPath mount | Cluster-admin binding | Delete K8S events | Mount service principal | Access Kubelet API | Container service account | Resource Hijacking | |
| Kubeconfig file | New container | Kubernetes CronJob | hostPath mount | Pod / container name similarity | Access container service account | Network mapping | Cluster internal networking | Denial of service | |
| Application vulnerability | Application exploit (RCE) | Malicious admission controller | Access cloud resources | Connect from Proxy server | Applications credentials in configuration files | Access Kubernetes dashboard | Applications credentials in configuration files | ||
| Exposed Dashboard | SSH server running inside container | Access managed identity credential | Instance Metadata API | Writable volume mounts on the host | |||||
| Exposed sensitive interfaces | Sidecar injection | Malicious admission controller | Access Kubernetes dashboard | ||||||
| Access tiller endpoint | |||||||||
| CoreDNS poisoning | |||||||||
| ARP poisoning and IP spoofing |
The MITRE ATT&CK® (Adversarial Tactics, Techniques and Common Knowledge) framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. In this framework, here we cover the Tactics, Techniques, and Procedures (TTPs) to map Kubernetes Security risks and also the related Kubernetes Goat scenarios.
- Learn more about MITRE ATT&CK framework at https://attack.mitre.org
- Learn more about MITRE ATT&CK framework for Kubernetes at https://microsoft.github.io/Threat-Matrix-for-Kubernetes
🔥 Tactic - Initial Access
The initial access tactic consists of techniques that are used for gaining access to the resource. In containerized environments, those techniques enable first access to the cluster. This access can be achieved directly via the cluster management layer or, alternatively, by gaining access to a malicious or vulnerable resource that is deployed on the cluster.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Using cloud credentials | |
| Compromised image in registry | ⎈ Attacking private registry |
| Kubeconfig file | |
| Application vulnerability | ⎈ SSRF in the Kubernetes (K8S) world ⎈ DIND (docker-in-docker) exploitation |
| Exposed sensitive interfaces | ⎈ NodePort exposed services |
🔥 Tactic - Execution
The execution tactic consists of techniques that are used by attackers to run their code inside a cluster.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Exec into container | ⎈ Gaining environment information |
| bash/cmd inside container | ⎈ Gaining environment information |
| New container | ⎈ Hacker container preview |
| Application exploit (RCE) | ⎈ DIND (docker-in-docker) exploitation |
| SSH server running inside container | |
| Sidecar injection |
🔥 Tactic - Persistence
The persistence tactic consists of techniques that are used by attackers to keep access to the cluster in case their initial foothold is lost.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Backdoor container | ⎈ Analyzing crypto miner container |
| Writable hostPath mount | ⎈ Container escape to the host system |
| Kubernetes CronJob | ⎈ Hidden in layers |
| Malicious admission controller | |
| Container service account | ⎈ Helm v2 tiller to PwN the cluster - [Deprecated] ⎈ RBAC least privileges misconfiguration |
| Static pods |
🔥 Tactic - Privilege Escalation
The privilege escalation tactic consists of techniques that are used by attackers to get higher privileges in the environment than those they currently have. In containerized environments, this can include getting access to the node from a container, gaining higher privileges in the cluster, and even getting access to the cloud resources.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Privileged container | ⎈ Container escape to the host system |
| Cluster-admin binding | ⎈ Helm v2 tiller to PwN the cluster - [Deprecated] |
| hostPath mount | ⎈ Container escape to the host system |
| Access cloud resources | ⎈ SSRF in the Kubernetes (K8S) world |
🔥 Tactic - Defense Evasion
The defense evasion tactic consists of techniques that are used by attackers to avoid detection and hide their activity.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Clear container logs | ⎈ Container escape to the host system |
| Delete K8S events | ⎈ Helm v2 tiller to PwN the cluster - [Deprecated] |
| Pod / container name similarity | ⎈ Hacker container preview |
| Connect from proxy server |
🔥 Tactic - Credential Access
The credential access tactic consists of techniques that are used by attackers to steal credentials. In containerized environments, this includes credentials of the running application, identities, secrets stored in the cluster, or cloud credentials.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| List K8S secrets | ⎈ RBAC least privileges misconfiguration |
| Mount service principal | |
| Container service account | ⎈ RBAC least privileges misconfiguration |
| Application credentials in configuration files | |
| Access managed identity credentials | |
| Malicious admission controller |
🔥 Tactic - Discovery
The discovery tactic consists of techniques that are used by attackers to explore the environment to which they gained access. This exploration helps the attackers to perform lateral movement and gain access to additional resources.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Access Kubernetes API server | ⎈ KubeAudit - Audit Kubernetes clusters |
| Access Kubelet API | ⎈ Container escape to the host system |
| Network mapping | ⎈ Kubernetes namespaces bypass |
| Exposed sensitive interfaces | ⎈ Kubernetes namespaces bypass ⎈ NodePort exposed services |
| Instance Metadata API | ⎈ SSRF in the Kubernetes (K8S) world |
🔥 Tactic - Lateral Movement
The lateral movement tactic consists of techniques that are used by attackers to move through the victim’s environment. In containerized environments, this includes gaining access to various resources in the cluster from a given access to one container, gaining access to the underlying node from a container, or gaining access to the cloud environment.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Access cloud resources | ⎈ SSRF in the Kubernetes (K8S) world |
| Container service account | |
| Cluster internal networking | ⎈ Kubernetes namespaces bypass |
| Application credentials in configuration files | |
| Writable hostPath mount | ⎈ Container escape to the host system |
| CoreDNS poisoning | |
| ARP poisoning and IP spoofing | ⎈ Kubernetes namespaces bypass |
🔥 Tactic - Collection
Collection in Kubernetes consists of techniques that are used by attackers to collect data from the cluster or through using the cluster.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Images from a private registry | ⎈ Attacking private registry |
| Collecting data from pod | ⎈ Gaining environment information |
🔥 Tactic - Impact
The Impact tactic consists of techniques that are used by attackers to destroy, abuse, or disrupt the normal behavior of the environment.
| 🧰 Techniques | 🐐 Kubernetes Goat Scenarios |
|---|---|
| Data destruction | ⎈ DIND (docker-in-docker) exploitation ⎈ Container escape to the host system |
| Resource hijacking | ⎈ DoS the Memory/CPU resources |
| Denial of service | ⎈ DoS the Memory/CPU resources |