Kubernetes (All Versions)

Creation or modification of Kubernetes pods with the HostNetwork attribute enabled allows containers to escape their network namespace, potentially enabling host-level traffic interception and privilege escalation.

Attackers with initial cluster access are abusing the Kubernetes TokenRequest API to mint arbitrary service account tokens, facilitating privilege escalation, cloud resource pivoting, and persistence without leaving filesystem artifacts.

Adversaries performing hands-on-keyboard enumeration within compromised containers are detected by correlating interactive process execution with forbidden Kubernetes API audit responses.

Adversaries may move laterally or perform reconnaissance by compromising a container and using interactive shells or networking utilities to query the Kubernetes API server directly.