A Kubernetes attack simulation framework for testing security monitoring and detection capabilities. This toolkit deploys realistic post-exploitation techniques within containerized environments to validate whether security controls will detect real attacks.

This framework simulates attack patterns observed in actual Kubernetes compromises, including container escapes, credential theft, cryptomining, data exfiltration, and command-and-control communications. Security teams use it to:

• Test detection coverage for container-based attacks
• Validate CSPM, EDR, and SIEM alert configurations
• Measure incident response effectiveness
• Conduct purple team exercises with realistic attack scenarios

• Container escape: Executes privileged container attacks with host filesystem mounting and namespace manipulation
• Credential exfiltration: Extracts Kubernetes service account tokens and AWS credentials from mounted secrets
• Network reconnaissance: Performs concurrent port scanning and cluster network mapping
• Persistence mechanisms: Installs cron-based persistence and demonstrates common backdoor techniques
• Command & control: Establishes reverse shell connections to a simulated C2 infrastructure
• Data exfiltration: Transfers stolen credentials and sensitive files over HTTP
• Cryptomining: Deploys XMRig miner with process hiding via LD_PRELOAD manipulation
• Defense evasion: Uses eBPF-based rootkits and anti-forensics techniques to evade detection

• Kubernetes cluster (local: minikube/kind, cloud: EKS/GKE/AKS)
• kubectl configured with cluster-admin permissions
• Docker for building container images
• Understanding of Kubernetes security primitives and common attack vectors

# Package attack simulation payloads
tar -cf sim.tar dropper.sh run.sh exfil.py portscan.py

# Build and push attack simulation container
docker build -f Dockerfile.sim -t bilals12/attack-sim:latest .
docker push bilals12/attack-sim:latest

# Build and push C2 payload server
docker build -f Dockerfile.payload -t bilals12/payload-server:latest .
docker push bilals12/payload-server:latest

Basic deployment without AWS credential theft simulation:

# Deploy C2 payload server
kubectl apply -f payload-server.yaml

# Deploy attack simulation pod
kubectl apply -f attack-sim-deploy.yaml

# Stream attack execution logs
kubectl logs -f sim-pod

Full deployment including AWS credential theft:

# Create AWS credentials secret (uses dummy credentials by default)
kubectl apply -f aws-credentials.yaml

# Deploy complete attack infrastructure
kubectl apply -f payload-server.yaml
kubectl apply -f attack-sim-deploy.yaml

# Monitor attack progression
kubectl logs -f sim-pod

# View attack execution report with timestamps and results
kubectl exec sim-pod -- cat /dev/shm/.../...HIDDEN.../report.json

# Monitor C2 server logs for exfiltration events
kubectl logs -f $(kubectl get pods -l app=payload-server -o name | head -n1)

# List files exfiltrated to C2 server
kubectl exec $(kubectl get pods -l app=payload-server -o name | head -n1) -- ls -la /payloads/uploads

Configure these environment variables in attack-sim-deploy.yaml:

Configure these environment variables in payload-server.yaml:

1. attack-sim: Privileged pod that executes attack techniques in parallel using bash orchestration
2. payload-server: HTTP-based C2 server that receives exfiltrated data and serves reverse shell payloads

This framework generates telemetry for testing security monitoring platforms. When deployed in a Wiz-monitored cluster, expect the following detection alerts:

This toolkit is designed exclusively for authorized security testing in controlled environments.

• Purple team exercises in dedicated test clusters
• Security control validation with proper authorization
• Detection engineering and threat hunting development
• Incident response training scenarios

This framework includes:

• Intentionally misconfigured privileged containers
• Simulated attack binaries (xmx2, www, noumt, pt)
• Dummy AWS credentials with no real cloud access
• C2 infrastructure for controlled exfiltration testing

• Only deploy in non-production, isolated test environments
• Require explicit authorization before deployment
• Do not modify for unauthorized security testing
• Ensure security monitoring is active during testing

Remove all attack simulation components from the cluster:

# Delete attack simulation pod
kubectl delete -f attack-sim-deploy.yaml

# Delete C2 payload server
kubectl delete -f payload-server.yaml

# Delete credential secrets
kubectl delete secret aws-credentials --ignore-not-found
kubectl delete sealedsecret aws-credentials --ignore-not-found

# Verify complete removal
kubectl get pods -l app=attack-sim
kubectl get pods -l app=payload-server

Symptom: dropper.sh reports "Server unreachable" or connection timeout

Resolution:

# Verify payload server pod is running
kubectl get pods -l app=payload-server

# Check service DNS resolution
kubectl exec sim-pod -- nslookup payload-server.default.svc.cluster.local

Symptom: No data appears in C2 server uploads directory

Resolution:

# Verify NetworkPolicy allows egress to payload server
kubectl describe netpol allow-payload-access

# Check C2 server logs for connection attempts
kubectl logs -l app=payload-server

Symptom: Security monitoring does not alert on XMRig execution

Resolution: Increase miner execution time to allow detection rules to trigger:

• Edit MINER_DURATION to 120 in attack-sim-deploy.yaml
• Redeploy simulation pod

Symptom: SealedSecret fails to decrypt in target cluster

Resolution: Regenerate sealed secret using the target cluster's sealing key (see sealed-aws-credentials.yaml for template)

Results from refactoring the original 844-line monolithic attack script:

The refactored architecture executes multiple attack techniques simultaneously, reducing overall runtime while generating more realistic attack patterns for detection testing.

MIT - for educational and defensive security purposes only