Topic

Post-Exploitation

Attacker activity after initial access is achieved: privilege reuse, credential harvesting, impersonation and lateral movement inside an already-compromised environment.

Current clusters

security1 publisher

Root on a Kubernetes node makes the SPIRE agent sign a neighbour's identity for you

Unit 42 showed that spoofing the cgroup data a SPIRE agent reads during workload attestation makes it hand over a co-located workload's SVID, and released a tool so defenders can size the loss per node.

Publishers:unit42.paloaltonetworks.com

Reality

Evidence68
Adoption22
Hype gap+18
Incentives65
Confidence55