☸️ RBAC Honey ClusterRole

Fake K8s ClusterRoles with attractive names.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

Create K8s ClusterRoles with attractive names like cluster-admin-legacy, debug-all-namespaces bound to fake ServiceAccounts. Any kubectl auth can-i check or token use against these roles triggers an alert.

Implementation requirements

K8s RBAC write access
ClusterRole + ClusterRoleBinding YAML manifests
Audit logging enabled on K8s API server (must capture --audit-policy-file events)
ServiceAccount tokens distributed as breadcrumbs (in configmaps, mounted volumes, or endpoint file systems)
Rollback: Delete the role binding first, then the ClusterRole and its service account.
Upkeep: Re-check after cluster upgrades. Monthly proof-of-life permission check from a test identity.

Technologies

Kubernetes

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1078 Valid Accounts	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078 Valid Accounts	Persistence	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1098.006 Additional Container Cluster Roles	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.006 Additional Container Cluster Roles as an adversary behaviour.
T1078 Valid Accounts	Privilege Escalation	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078 Valid Accounts	Stealth	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.

Evidence

Container Orchestration Honeypot: Observing Attacks in the Wild — Spahn, N.; Hanke, N.; Holz, T.; Kruegel, C.; Vigna, G., RAID 2023 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Container Orchestration Honeypot: Observing Attacks in the Wild" — RAID (Research in Attacks, Intrusions and Defenses), 2023.