Clankerusecase
Kubernetes detection coverage
 ← Back to main site
Home/ Targets/ Kubernetes

⎈Kubernetes detections

Clankerusecase tracks 59 detection use cases covering the Kubernetes attack surface across 41 MITRE ATT&CK techniques.

Detections targeting Kubernetes clusters — audit logs, pod creation, RBAC, container escapes.

Open Detection Library → View on the matrix
59Use cases
41Techniques
14Articles
6Kill-chain phases

Top techniques on Kubernetes (25)

T1204User Execution20T1552.001Credentials In Files9T1190Exploit Public-Facing Application8T1552.007Container API5T1526Cloud Service Discovery5T1528Steal Application Access Token5T1609Container Administration Command4T1098Account Manipulation3T1611Escape to Host3T1610Deploy Container3T1105Ingress Tool Transfer3T1555Credentials from Password Stores2T1041Exfiltration Over C2 Channel2T1048Exfiltration Over Alternative Protocol2T1550.001Application Access Token2T1059Command and Scripting Interpreter2T1068Exploitation for Privilege Escalation2T1613Container and Resource Discovery2T1078.004Cloud Accounts2T1531Account Access Removal1T1548Abuse Elevation Control Mechanism1T1554Compromise Host Software Binary1T1555.003Credentials from Web Browsers1T1539Steal Web Session Cookie1T1572Protocol Tunneling1

Reconnaissance (1)

[LLM] Recon tool reading K8s service-account token or /proc/self/environ inside a container Bespoke recon · hunting DSΣPDDCS

Delivery (4)

[LLM] Malicious vault-addr annotation on ConfigMap/Secret admission (CVE-2026-54725) Bespoke delivery · alerting SΣPDD [LLM] Logging-operator Flow/Output CRD injects Fluentd @type exec block (CVE-2026-54680) Bespoke delivery · alerting SΣPDD [LLM] Anomalous EnvoyExtensionPolicy submitter / suspicious policy name Bespoke delivery · hunting SΣPDD [LLM] Docker / Kubernetes pull of compromised ghcr.io/elementary-data/elementary image Bespoke delivery · alerting DSΣPDDCS

Exploitation (5)

[WEEKLY] Public-Facing App Runtime Spawns Shell, LOLBin, or Container-Control Tool Internal exploit · alerting DSΣPDD [LLM] EnvoyExtensionPolicy Lua with double-slash path traversal to secrets (CVE-2026-53713) Bespoke exploit · alerting SΣPDD [LLM] EnvoyExtensionPolicy Lua invoking os/io/debug file primitives Bespoke exploit · hunting SΣPDD Article-specific behavioural hunt — Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks aga Bespoke exploit · hunting DSP [LLM] Anonymous access to Kubernetes aggregated API (CVE-2018-1002105 exploit surface) Bespoke exploit · hunting SΣPDDCW

Installation (5)

Kubernetes ClusterRole / binding deleted Internal install · alerting DD Kubernetes pod created with privileged flag Internal install · alerting DD Kubernetes RBAC role binding created Internal install · alerting DD Kubernetes admission webhook configuration modified Internal install · alerting DD [LLM] TeamPCP rope.pyz Dropper Infection Markers on Linux Bespoke install · alerting DSΣPDDCS

Command & Control (1)

[LLM] Egress to typosquatted C2 flipboxstudio.info (Laravel-Lang Composer SC) Bespoke c2 · alerting DSΣPDDCS

Actions on Objectives (43)

Kubernetes Secret accessed Internal actions · alerting DD [WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSP [WEEKLY] Dev/CI Toolchain Credential Read + Egress to Non-Canonical Registry Internal actions · alerting DSPDDCS Amazon EKS Kubernetes Pod scan detection ESCU actions · hunting P Kubernetes Abuse of Secret by Unusual Location ESCU actions · hunting P Kubernetes Abuse of Secret by Unusual User Agent ESCU actions · hunting P Kubernetes Abuse of Secret by Unusual User Group ESCU actions · hunting P Kubernetes Abuse of Secret by Unusual User Name ESCU actions · hunting P Kubernetes Anomalous Inbound Network Activity from Process ESCU actions · hunting P Kubernetes Anomalous Inbound Outbound Network IO ESCU actions · hunting P Kubernetes Anomalous Inbound to Outbound Network IO Ratio ESCU actions · hunting P Kubernetes Anomalous Outbound Network Activity from Process ESCU actions · hunting P Kubernetes Anomalous Traffic on Network Edge ESCU actions · hunting P Kubernetes Create or Update Privileged Pod ESCU actions · hunting P Kubernetes Cron Job Creation ESCU actions · hunting P Kubernetes DaemonSet Deployed ESCU actions · hunting P Kubernetes newly seen TCP edge ESCU actions · hunting P Kubernetes newly seen UDP edge ESCU actions · hunting P Kubernetes Node Port Creation ESCU actions · hunting P Kubernetes Pod Created in Default Namespace ESCU actions · hunting P Kubernetes Pod With Host Network Attachment ESCU actions · hunting P Kubernetes Previously Unseen Container Image Name ESCU actions · hunting P Kubernetes Previously Unseen Process ESCU actions · hunting P Kubernetes Process Running From New Path ESCU actions · hunting P Kubernetes Process with Anomalous Resource Utilisation ESCU actions · hunting P Kubernetes Process with Resource Ratio Anomalies ESCU actions · hunting P Kubernetes Shell Running on Worker Node ESCU actions · hunting P Kubernetes Shell Running on Worker Node with CPU Activity ESCU actions · hunting P Kubernetes Suspicious Image Pulling ESCU actions · hunting P Kubernetes Unauthorized Access ESCU actions · hunting P Hunting for Log4Shell ESCU actions · hunting P GCP Kubernetes cluster scan detection ESCU actions · alerting P [LLM] vault-secrets-webhook mints SA tokens via TokenRequest after admission (CVE-2026-54725) Bespoke actions · alerting SPDD [LLM] Build/attestation process egress to non-canonical OCI registry (@sigstore/oci cred leak, CVE-2026-59891) Bespoke actions · hunting DSPCS [LLM] Leaked SA token / file contents in EnvoyExtensionPolicy status (CVE-2026-53713 disclosure) Bespoke actions · alerting SΣPDD [LLM] Envoy Gateway ServiceAccount token reuse for anomalous K8s API actions Bespoke actions · hunting SΣPDD [LLM] Lateral movement via aws ssm send-command or kubectl exec spawned by python/node Bespoke actions · alerting DSΣPDDCSCW [LLM] Python Process Reading Multi-Cloud Credential Stores (durabletask Stealer Stage) Bespoke actions · hunting DSPDDCS [LLM] Kubernetes propagation via kubectl staged in /tmp (kubectl exec / get secrets) Bespoke actions · alerting DSΣPDDCS [LLM] Kubernetes privileged-pod DaemonSet fan-out from compromised LiteLLM workload Bespoke actions · hunting SPDD [LLM] In-cluster Kubernetes secret enumeration with Python user-agent (litellm stealer K8s pivot) Bespoke actions · alerting DSΣPDDCS [LLM] TeamPCP exfiltration archive — tpcp.tar.gz file creation on host Bespoke actions · alerting DSΣPDD [LLM] Anonymous principal reaching kubelet/pod proxy subresources (CVE-2018-1002105 tunnel) Bespoke actions · alerting SΣPDDCW

Recent articles citing Kubernetes-targeted detections

crit [GHSA / CRITICAL] CVE-2026-54725: vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-ser
high Four incident-response decisions from the Hugging Face breach
crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution
crit [GHSA / CRITICAL] CVE-2026-59891: Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
crit [GHSA / CRITICAL] CVE-2026-53713: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secr
high Why EDR and proxy won’t save you from supply chain malware
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again!
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection
high You Patched LiteLLM, But Do You Know Your AI Blast Radius?
crit litellm: Credential Stealer Hidden in PyPI Wheel
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags
high Critical Arbitrary Code Execution Vulnerability Found in Kubernetes