Engage Goals: EGO0001 Expose, EGO0003 Elicit
Engage Approach: EAP0001 Collect, EAP0002 Detect
Engage Actions: EAC0015 Information Manipulation, EAC0018 Security Controls
Name of Element: Mimicked Kubernetes Pods
Description of Element:
This element involves deploying deceptive Kubernetes pods that mimic legitimate pods but perform deceptive actions or contain deceptive information.
Technical Context:
Placement: Within the Kubernetes cluster, alongside other legitimate pods
This element can be used to identify attackers attempting to compromise or gain access to sensitive data within Kubernetes pods or to gather information about attacker tools and techniques
Other:
Att&ck/Engage Mapping: T1005 Data from Local System / E1506 Decoy System
This element requires careful planning and execution to ensure that it does not interfere with the normal operation of the Kubernetes environment.