A threat model systematically identifies threats affecting an environment, then describes their relevance, potential effect, actors, targets, attack vectors, and indicators. Its results help prioritize threat-hunting work rather than treating every possible threat equally. section 5.1.1 section 5.3.1
Build a useful threat model around these operational elements:
- Source and threat: state where the attack originates and what compromise or unauthorized action may occur. section 5.1.1
- Actor and target: identify plausible adversaries and the containers, nodes, applications, or infrastructure they may affect. section 5.1.1
- Attack vector and effect: describe how access is obtained and what control, persistence, or malicious activity could follow. section 5.1.1
- Priority and preparation: select threats with the highest relevance and effect, formulate a hypothesis, define scope, and gather suitable event sources. section 5.1.1 section 5.3.1
Kubernetes container escape
A public-cloud Kubernetes threat model considers an attacker escaping a privileged container, reaching hosting nodes and other containers, querying the Kubernetes API server, and provisioning crypto-mining, botnet, or Tor resources. The scenario identifies malicious individuals, state-sponsored groups, or organized crime as actors; containers and nodes as targets; privileged access as the attack vector; and potential control of the cluster as the effect. Unexpected API calls, accounts, and locations become indicators for a prioritized hunt. section 5.1.1
Figure 5.5 Threat-hunting process: Preparation phase
Use the preparation workflow to connect a selected threat scenario with its hunting hypothesis, scope, infrastructure context, and available logs. section 5.3.1
