Runs an arbitrary command inside an already-running pod through the Kubernetes API's pods/exec subresource, giving an interactive shell without deploying anything new. With a token that has the exec verb, an operator can pivot into any reachable workload and, as shown, spawn a reverse shell back to a listener.
Use Interactively run commands or pop a shell inside an existing pod using only exec RBAC, avoiding creation of new objects.
Detection: Kubernetes API audit log create events on the pods/exec subresource (objectRef.subresource=exec). Alert on exec into production/system namespaces, exec by service-account identities that normally never exec, and exec commands spawning shells (sh, bash, /dev/tcp). Correlate with kubelet logs.
Verified
✓ MITRE T1609 page explicitly names `kubectl exec` as a procedure; kubectl_exec generated docs confirm -it/-n/-- syntax. Binary absent from GTFOBins/LOLBAS/WADComs.
Lists Kubernetes Secret objects and dumps their contents. Secret data is only base64-encoded in the API, so a single get/list on the secrets resource returns service-account tokens, registry pull creds, TLS keys and app passwords in recoverable form. --all-namespaces harvests every namespace the identity can read.
Use Harvest tokens, cloud keys and passwords cluster-wide from the API when the compromised identity holds get/list on secrets.
Detection: Enable RequestResponse-level audit on the secrets resource. Alert on list/get across many namespaces or all-namespaces, especially from service accounts. Red Canary Atomic T1552.007 mirrors this. Watch /api/v1/secrets and /api/v1/namespaces/*/secrets GET/LIST spikes.
Verified
✓ MITRE T1552.007 (Container API) description explicitly covers using the Kubernetes API to retrieve Secrets; Red Canary Atomic T1552.007 replicates `kubectl get secrets`. Secrets are base64, not encrypted (k8s Secret docs).
Uses the --overrides flag of kubectl run to inject a raw pod spec that is privileged, shares the host PID namespace and mounts the node root filesystem via a hostPath volume. Once scheduled, chroot /host yields a root shell on the underlying node, escaping the cluster's isolation boundary.
Use Escape from cluster tenant to full node root when the identity can create pods with privileged/hostPath specs (no PodSecurity restricted).
kubectlrunpod-x-nns-x--restart=Never-it--rm--image=alpine--overrides='{"spec":{"hostPID":true,"containers":[{"name":"c","image":"alpine","stdin":true,"tty":true,"command":["/bin/sh"],"securityContext":{"privileged":true},"volumeMounts":[{"name":"host","mountPath":"/host"}]}],"volumes":[{"name":"host","hostPath":{"path":"/"}}]}}'# then inside: chroot /host sh
Detection: Audit pods/create where securityContext.privileged=true, hostPID/hostNetwork/hostIPC=true, or volumes[].hostPath is set (especially path /). Enforce Pod Security Admission 'restricted' or an admission controller (OPA/Kyverno) to block these specs and alert on rejections.
Verified
✓ `--overrides` is a documented kubectl run flag (inline JSON merged into the generated object); kubernetes/kubectl#721 and HackTricks document it as the privileged/hostPath escape workaround. T1611 (Escape to Host)+T1610 (Deploy Container) correct.
kubectl debug node creates a debugging pod that runs in the target node's host namespaces with the node root filesystem mounted at /host. Combined with --profile=sysadmin (privileged) and chroot /host it provides root-level access to the node's disk and processes, a supported feature repurposed for host takeover.
Use Obtain node filesystem/root access through the sanctioned node-debug path when create-pods on nodes is permitted.
kubectldebugnode/node-x-it--image=alpine--profile=sysadmin# then inside the debug pod: chroot /host sh
Detection: Audit for pod create with names matching node-debugger-* and node-scoped debug pods carrying host namespaces or --profile=sysadmin. Alert on debug pods mounting /host or running chroot. Restrict the node/debug capability via RBAC.
Verified
✓ kubernetes.io 'Debugging Kubernetes Nodes With Kubectl' page (fetched live) confirms node root mounts at /host, that plain debug is not privileged so chroot /host fails unless `--profile=sysadmin` is used; T1611. Both refs live.
Copies files and directories out of or into a pod. Under the hood kubectl cp streams a tar archive through the pods/exec subresource (the container image must contain tar), so it doubles as a data-exfiltration and tool-staging channel that only needs exec permission.
Use Pull sensitive files out of a pod or stage attacker tooling into it using nothing but exec/cp rights.
Detection: cp rides pods/exec, so audit exec create events invoking tar (command contains 'tar -cf -' or 'tar -xmf -'). Alert on exec+tar into/out of sensitive workloads and on large streamed transfers correlated with exec sessions.
Verified
✓ kubectl_cp generated docs confirm cp streams a tar via the exec subresource and requires tar in the container image; T1609 justified because cp executes tar in-container. Absent from GTFOBins/LOLBAS.
Queries the RBAC authorizer (SelfSubjectRulesReview / SelfSubjectAccessReview) to enumerate exactly which resources and verbs the current identity is allowed. --list dumps the full permission matrix; --as combines with impersonation rights to map another subject's power without using its credentials.
Use Enumerate the compromised token's RBAC reach (and plan escalation) before taking any noisy action.
Detection: Audit create events on selfsubjectrulesreviews / selfsubjectaccessreviews (a public Sigma rule flags RBAC permission listing). A burst of can-i / --list right after a new token appears is a strong recon signal; alert on impersonation (--as) combined with these reviews.
Verified
✓ can-i --list uses SelfSubjectRulesReview (k8s authz docs, 'Checking API access'); detection.fyi Sigma rule 'RBAC Permission Enumeration Attempt' fetched live (it tags T1069.003/T1087.004 — parent T1069 retained as correct).
Opens a tunnel from the operator's machine, through the API server and kubelet, to a port on a pod or service via the pods/portforward subresource. This reaches ClusterIP-only services (databases, internal admin UIs, dashboards) that are otherwise unroutable, and --address 0.0.0.0 can expose the tunnel to other hosts.
Use Reach cluster-internal services (DBs, dashboards, metadata proxies) from outside without deploying a pod.
Detection: Audit create on the pods/portforward subresource (objectRef.subresource=portforward). Alert on port-forward to sensitive services (etcd, databases, dashboards), long-lived forwards, and --address bindings other than localhost.
Verified
✓ Command real: `kubectl port-forward` with the pods/portforward subresource and the `--address` flag are documented in kubectl docs. FIX: MITRE changed T1609->T1090.001 (Internal Proxy) and reference swapped accordingly — T1609 is defined as executing commands within a container, which port-forward does not do; it establishes a proxy tunnel to internal services.
Requests a bound service-account token through the TokenRequest API. An identity that can create serviceaccounts/token for a more-privileged service account can mint a fresh bearer token for it and assume its permissions, with --duration pushing the expiry far out.
Use Mint a valid bearer token for a higher-privileged service account to escalate or persist.
Detection: Audit create on the serviceaccounts/token subresource (TokenRequest). Alert when a subject requests tokens for service accounts it does not own, on unusually long --duration / requested expirationSeconds, and on token requests for privileged SAs (e.g. cluster-admin-bound).
Verified
✓ kubectl_create_token generated docs confirm `create token` is backed by the TokenRequest API and that `--duration` sets the requested token lifetime; T1528 (Steal Application Access Token) fits assuming a higher-priv SA. Server may cap very long durations, but the flag is real.
Enumerates cluster resources: pods and their node placement/IPs, nodes and addresses, and full object manifests. -o yaml exposes environment variables, mounted volumes, image references and annotations that frequently leak credentials and reveal the escape/lateral-movement surface.
Use Map workloads, nodes and embedded config/secrets to plan lateral movement and host escape.
Detection: Audit high-volume list/get across pods, nodes and other resources (especially -A / cluster-scoped) from a single identity in a short window. Baseline normal read patterns per service account and alert on broad enumeration by identities that usually touch one namespace.
Verified
✓ kubectl_get generated docs confirm -A/--all-namespaces, -o wide and -o yaml; T1613 (Container and Resource Discovery) is the correct technique for cluster resource enumeration.