☸️ Admission Webhook Trap

Mutating webhook injecting monitoring sidecars into honey pods.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Deploy a mutating admission webhook that intercepts pod creation requests. If a pod is scheduled into a honey namespace, the webhook silently injects monitoring sidecars (tcpdump, process monitors) into the pod without the attacker's knowledge.

Implementation requirements

K8s MutatingAdmissionWebhook configuration
Sidecar container images for monitoring (lightweight, no resource impact)
TLS certificates for webhook endpoint
Network policy ensuring sidecar telemetry reaches SIEM
Rollback: Delete the webhook configuration first, because a broken admission webhook can block pod creation, then remove its service.
Upkeep: Watch the webhook's certificate expiry and response time. Test it after every cluster upgrade.

Technologies

ContainerKubernetes

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1609 Container Administration Command	Execution	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: a fake kubeconfig pointing at a monitored API server; any attempt to use it (e.g. kubectl exec) raises an alert. Backed by D008 (honey kubeconfig). Honeypot studies checked so far do not document kubectl exec specifically.
T1610 Deploy Container	Execution	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — High-interaction Docker and Kubernetes honeypots were attacked within minutes; attackers requested privileged containers on the open Docker daemon and created Pods and a DaemonSet to run XMRig. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — An exposed Docker API honeypot received 850 attacks in 50 days; Kinsing was the most common. MITRE ATT&CK Enterprise v20.0 — T1610 procedure examples: TeamTNT, Kinsing and Doki deploy containers via exposed container APIs.

Evidence

Microservice-Oriented Cyber Deception Platform with Containerized Honeypots and Real-Time Telemetry — Shahzad, M.; Saleh, M. H., MDPI Journal of Cybersecurity and Privacy 6(4) 2026 peer-reviewed
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Microservice-Oriented Cyber Deception Platform with Containerized Honeypots and Real-Time Telemetry" — MDPI Journal of Cybersecurity and Privacy, 2026.