kube-raid
Built a TypeScript Kubernetes offensive-security framework for controlled simulation of adversarial behavior using modular techniques mapped to MITRE ATT&CK.
ATT&CK-aligned • Modular techniques • Controlled simulation
The Challenge
Kubernetes security controls are difficult to validate with static configuration review alone. Teams also need safe, repeatable ways to exercise detections and observe how defensive controls respond to realistic cluster behaviors.
The Solution
Built a TypeScript-based framework that represents Kubernetes adversary behaviors as modular, ATT&CK-aligned techniques. The design separates technique selection and execution so scenarios can be composed for authorized lab and validation environments.
Architecture
Implementation Process
Modeled Kubernetes-focused behaviors as discrete techniques with consistent interfaces
Mapped modules to MITRE ATT&CK tactics and techniques for a shared security vocabulary
Created an execution layer for selecting and running controlled scenarios
Structured output so operators can connect simulated behavior to defensive observations
Results & Impact
Created a reusable framework for Kubernetes security validation exercises
Made individual adversary behaviors modular and easier to extend
Connected technical simulations to the MITRE ATT&CK knowledge model
Supported repeatable testing in explicitly authorized environments