DEEP DIVE · 8 min read
Kubernetes Attack Paths You Should Know
Kubernetes makes lateral movement easy by design. Service accounts, host mounts and the API server form a triangle that turns a single RCE into cluster compromise faster than most teams realize.
Pod escapes
Privileged containers, hostPath mounts, hostPID and dangerous capabilities all let an attacker break out to the node.
Service-account abuse
Default tokens with cluster-admin still exist in the wild. Once mounted, the attacker talks straight to the API server.
- Audit RBAC for wildcard verbs
- Disable automountServiceAccountToken where unused
- Bind ClusterRoles tightly
Detection that actually works
Watch for exec into pods, unexpected API calls, and new pods landing on sensitive nodes. Falco rules + audit logs catch most of it.
Tools mentioned
kubectlkube-hunterPeiratesKubescapeFalco
⟩ takeaway
Treat the cluster as one big trust boundary. Anything inside can become everything inside.
⟩ keep reading
Related articles
Mobile Malware in 2026: How It Gets In and How to Stay Safer
Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.
Phishing Defense That Actually Works
AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.
Splunk Detection Tips: From Noisy Alerts to Real-Time Signal
SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.