🖥️ Honey Container/Pod

Fake K8s pods or Docker containers in clusters.

→ Explore in ATT&CK matrix (15 mappings) Deployment detail

What it is

A pod or container deployed among real workloads, with a plausible image and labels but no service-account rights, no host access and no route out. Attackers who reach a cluster exec into running containers to look for secrets and move on. Exec, attach and port-forward on the decoy pod are recorded by the Kubernetes audit log and runtime sensors.

Implementation requirements

Deploy a Deployment in a namespace named like real ones, with a plausible image, labels and resource requests. Minimal CPU and memory
Set automountServiceAccountToken: false, or use a service account bound to no roles. No hostPath, no privileged mode, no real secrets mounted
Add a NetworkPolicy that denies egress except to your collector (it only takes effect if the cluster's network plugin enforces NetworkPolicy)
Monitoring: an audit-policy rule that records the decoy pod's pods/exec, pods/attach and pods/portforward subresources. Add a runtime sensor (Falco or Tetragon) rule for a shell spawned in the container
Managed clusters, check before relying on it: EKS, turn on the audit control-plane log type (off by default). AKS, add a diagnostic setting with category kube-audit; the cheaper kube-audit-admin leaves out get and list. GKE, writes go to Admin Activity logs (always on) but get and list go to Data Access logs, which are off by default. Self-managed, the API server logs nothing until it is started with an audit policy. Confirm with the test below that the exec, attach and port-forward events actually arrive
On managed clusters, test with a real kubectl exec that the event reaches your log. Newer kubectl versions change the request type used for exec, which can change which log category records it
OPSEC: the image, labels and restart history should match neighbouring workloads
Rollback: Delete the Deployment, its NetworkPolicy and the audit-policy rule. Delete the decoy namespace if it was created for this.
Upkeep: Bump the image alongside neighbouring workloads. Monthly proof-of-life kubectl exec.

Technologies

ContainerKubernetesAWSAzureGCP

ATT&CK coverage 15

Technique	Tactic	Status	Confidence	Tier
T1552.007 Container API	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.007 Container API as an adversary behaviour.
T1613 Container and Resource Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server (e.g. kubectl get pods) raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1613 to its Lures activity.
T1059 Command and Scripting Interpreter	Execution	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — Attacker shell payloads (bash, base64-decoded scripts) were captured on the container honeypot. Cowrie — SSH and Telnet honeypot — Cowrie logs the shell commands an intruder runs on the SSH/Telnet honeypot.
T1059.004 Unix Shell	Execution	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1059.004 Unix Shell as an adversary behaviour.
T1059.006 Python	Execution	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1059.006 Python as an adversary behaviour.
T1204.003 Malicious Image	Execution	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1204.003 Malicious Image as an adversary behaviour. No source shows a decoy observing a user running a malicious image.
T1609 Container Administration Command	Execution	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: a fake kubeconfig pointing at a monitored API server; any attempt to use it (e.g. kubectl exec) raises an alert. Backed by D008 (honey kubeconfig). Honeypot studies checked so far do not document kubectl exec specifically.
T1610 Deploy Container	Execution	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — High-interaction Docker and Kubernetes honeypots were attacked within minutes; attackers requested privileged containers on the open Docker daemon and created Pods and a DaemonSet to run XMRig. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — An exposed Docker API honeypot received 850 attacks in 50 days; Kinsing was the most common. MITRE ATT&CK Enterprise v20.0 — T1610 procedure examples: TeamTNT, Kinsing and Doki deploy containers via exposed container APIs.
T1496 Resource Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero (474 miners tracked). Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On the Kubernetes honeypot, nearly all attacks aimed solely to run XMRig. MITRE ATT&CK Enterprise v20.0 — T1496.001: TeamTNT, Kinsing and Hildegard mine cryptocurrency on Docker and Kubernetes.
T1496.001 Compute Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1496.001 Compute Hijacking as an adversary behaviour.
T1098.006 Additional Container Cluster Roles	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.006 Additional Container Cluster Roles as an adversary behaviour.
T1543.005 Container Service	Persistence	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1543.005 Container Service as an adversary behaviour.
T1053.007 Container Orchestration Job	Privilege Escalation	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1053.007 Container Orchestration Job as an adversary behaviour. Workload creation is documented on the honeypot; a CronJob specifically is not.
T1068 Exploitation for Privilege Escalation	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1068 Exploitation for Privilege Escalation as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1068 to its Lures activity.
T1611 Escape to Host	Privilege Escalation	confirmed	strong	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the honeypot escaped the container to the host (chroot to the host filesystem) and set up persistence there via SSH keys and crontab.

Evidence

Decoy Environment (D3-DE) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Container Orchestration Honeypot: Observing Attacks in the Wild — Spahn, N.; Hanke, N.; Holz, T.; Kruegel, C.; Vigna, G., RAID 2023 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard