Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Exposed etcd → cluster-wide secret raid

etcd is reachable without mTLS — read every Secret in the cluster including service-account tokens that grant cluster-admin.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: a self-managed K8s cluster with etcd 2379/2380 reachable from the network and --client-cert-auth=false (or missing).

§ Steps

  1. 01
    Auth to API server with cluster-admin tokenInitial Access
    T1078— Valid Accounts
  2. 02
    Extract secrets (SA tokens, TLS keys, DB creds)Credential Access
    T1552— Unsecured Credentials
  3. 03
    etcdctl get / --prefix --keys-onlyCredential Access
    T1552— Unsecured Credentials
  4. 04
    Confirm no client-authInitial Access
    K-ETCD-OPEN— etcd Exposed Without Auth
  5. 05
    Backdoor admission webhookPersistence
    K-ADMISSION-WEBHOOK— Malicious Admission Webhook
  6. 06
    Find etcd portDiscovery
    N-NMAP-INTERNAL— Internal Nmap Sweep

§ References

§ Frequently asked

What is the "Exposed etcd → cluster-wide secret raid" attack path?
etcd is reachable without mTLS — read every Secret in the cluster including service-account tokens that grant cluster-admin. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Auth to API server with cluster-admin token (T1078) — a initial access primitive. Assumed environment: a self-managed K8s cluster with etcd 2379/2380 reachable from the network and --client-cert-auth=false (or missing).
What is the final impact of this kill-chain?
The final step lands on Find etcd port (N-NMAP-INTERNAL), which falls under Discovery. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers