☸️ Etcd Honey Data

Fake secrets injected into etcd backing store.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Inject fake secrets and configuration data directly into etcd (the K8s backing store). Attackers who gain direct etcd access (a critical cluster compromise) will find planted credentials that lead to DOAR-controlled infrastructure.

Implementation requirements

Direct etcd access (extremely privileged — only for dedicated honey clusters)
Fake secrets stored under realistic key paths (/registry/secrets/production/db-credentials)
Monitoring: etcd audit logs, or wrapper proxy logging all reads
Rollback: Back up etcd, then delete the planted keys and revoke the credentials they lead to.
Upkeep: Check that planted data survives etcd restores and migrations. Quarterly proof-of-life read.

Technologies

Kubernetes

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1552.007 Container API	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.007 Container API as an adversary behaviour.
T1611 Escape to Host	Privilege Escalation	confirmed	strong	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the honeypot escaped the container to the host (chroot to the host filesystem) and set up persistence there via SSH keys and crontab.

Evidence

Container Orchestration Honeypot: Observing Attacks in the Wild — Spahn, N.; Hanke, N.; Holz, T.; Kruegel, C.; Vigna, G., RAID 2023 peer-reviewed
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Extension of container orchestration honeypot research (RAID 2023).