☸️ Decoy Kubeconfig

Fake .kube/config files planted on developer endpoints.

→ Explore in ATT&CK matrix (1 mappings) Deployment detail

What it is

A kubeconfig file or extra context planted on developer endpoints, pointing at a decoy cluster or a credential with no rights. Developer machines are a common way into clusters. Any use of the credential appears in the Kubernetes audit log, and endpoint monitoring can also record other processes reading the file.

Implementation requirements

Plant a kubeconfig in ~/.kube/config (or a second context in an existing one) on developer endpoints, pointing at a decoy cluster or at a credential bound to no roles. See D008 for the server-side setup
Monitoring: Kubernetes audit events for the decoy identity, and an endpoint rule (auditd, EDR) for other processes reading the file
Managed clusters, check before relying on it: EKS, turn on the audit control-plane log type (off by default). AKS, add a diagnostic setting with category kube-audit; the cheaper kube-audit-admin leaves out get and list. GKE, writes go to Admin Activity logs (always on) but get and list go to Data Access logs, which are off by default. Self-managed, the API server logs nothing until it is started with an audit policy. A stolen kubeconfig's first use is usually a read (kubectl get), so without these settings the first use may never be logged
Safety: the credential reaches no real cluster with any rights. OPSEC: context and cluster names matching the developer's real ones
Rollback: Remove the planted file or extra context. Revoke the credential behind it.
Upkeep: Re-issue the credential before it expires. Monthly proof-of-life request with the planted file.

Technologies

KubernetesAWSAzureGCPLinux

ATT&CK coverage 1

Technique	Tactic	Status	Confidence	Tier
T1543.005 Container Service	Privilege Escalation	theoretical	moderate	T4
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1543.005 Container Service as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
Container Orchestration Honeypot: Observing Attacks in the Wild — Spahn, N.; Hanke, N.; Holz, T.; Kruegel, C.; Vigna, G., RAID 2023 peer-reviewed
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard