🎫 Honey Kubeconfig

Fake K8s configs on bastion hosts or in secrets stores.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

A kubeconfig file planted on bastion hosts, developer machines or CI runners, pointing at a decoy cluster or at a credential with no rights. A kubeconfig is a ready-made way into a cluster, so attackers who find one try it immediately. Every request made with it appears in the Kubernetes audit log under the decoy identity.

Implementation requirements

Plant a kubeconfig where real ones live: bastion hosts, developer machines, CI runners, a secrets store. Thinkst Canarytokens offers a Kubeconfig token if you do not want to run the endpoint yourself
Point it at an isolated decoy cluster, or at a real API server with a credential bound to no roles. The decoy cluster is safer: a stolen credential then cannot reach anything real
Monitoring: Kubernetes audit events whose user is the decoy credential's identity. Any request, including a denied one, is the signal
Managed clusters, check before relying on it: EKS, turn on the audit control-plane log type (off by default). AKS, add a diagnostic setting with category kube-audit; the cheaper kube-audit-admin leaves out get and list. GKE, writes go to Admin Activity logs (always on) but get and list go to Data Access logs, which are off by default. Self-managed, the API server logs nothing until it is started with an audit policy. A stolen kubeconfig's first use is usually a read (kubectl get), so without these settings the first use may never be logged
Safety: the credential has no RBAC bindings on any real cluster. OPSEC: cluster name, context name and server address in your normal naming scheme
Rollback: Delete the credential behind the kubeconfig (service-account token, certificate or decoy cluster user). Remove the planted files; tear down the decoy cluster if one was used.
Upkeep: Re-issue before the credential or certificate expires. Monthly proof-of-life kubectl get with the planted file.

Technologies

KubernetesAWSAzureGCP

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1552.007 Container API	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.007 Container API as an adversary behaviour.
T1613 Container and Resource Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server (e.g. kubectl get pods) raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1613 to its Lures activity.
T1609 Container Administration Command	Execution	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: a fake kubeconfig pointing at a monitored API server; any attempt to use it (e.g. kubectl exec) raises an alert. Backed by D008 (honey kubeconfig). Honeypot studies checked so far do not document kubectl exec specifically.
T1550 Use Alternate Authentication Material	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550 Use Alternate Authentication Material as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1550 to its Lures activity.
T1098.006 Additional Container Cluster Roles	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.006 Additional Container Cluster Roles as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard