The Kubernetes API server is the control-plane interface through which authorized tools such as kubectl communicate with a cluster and manage Kubernetes objects. Its requests expose operational and security evidence, including get, list, create, and delete activity. section 5.1.2
Attackers who escape a container or obtain permission to create a privileged container may use the API server to harvest cluster information and provision malicious workloads. Unexpected locations, accounts, agents, and pods are useful indicators. section 5.1.1
Use the API server as a practical hunting and detection surface:
- Collect and review audit logs for get, list, create, and delete requests, including requests made through kubectl. section 5.1.2
- Investigate successful calls from unexpected locations, accounts, or agents, and identify unknown pods running in the cluster. section 5.1.1
- Monitor API calls alongside unsafe workload deployments, default service-account changes, node logs, cloud-firewall logs, and other cloud API endpoints. section 5.1.2 section 5.3.3
Container escape and cluster abuse
An attacker uses a privileged container as a launchpad to reach the host and other workloads, then calls the Kubernetes API server to enumerate the cluster and deploy crypto-mining, botnet, or Tor-exit workloads. Hunters validate the hypothesis with API audit records and related host and network evidence before handing the case to incident response. section 5.1.1 section 5.3.3
Listing 5.1 Kubernetes cluster details
kubectl cluster-info #1 Kubernetes control plane is running at https://35.199.171.183 #2 ...
Inspect the kubectl command that displays the Kubernetes control-plane endpoint and confirms API-server connectivity. section 5.1.2
