<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-etcd-security-issues
description: >-
  Detect etcd security misconfigurations including unencrypted data at rest,
  missing TLS for peer/client communication, weak authentication, exposed
  endpoints, and insufficient backup encryption in Kubernetes clusters.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - etcd
  - encryption-at-rest
  - tls
  - kubernetes-secrets
  - data-store
  - backup-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552.007"]
---

# Detecting etcd Security Issues

## Overview

Detect etcd security misconfigurations including unencrypted data at rest, missing TLS for peer/client communication, weak authentication, exposed endpoints, and insufficient backup encryption in Kubernetes clusters.

Mode: `[MODE: BLUE]` — Detect etcd security gaps. `[MODE: RED]` — Exploit etcd misconfigurations (T1552.007).

## Prerequisites

| Requirement | Details |
|---|---|
| kubectl access with ability to read API server configuration | Required |
| etcdctl installed (for direct etcd checks) | Required |
| Access to control plane node or API server manifests | Required |

## Key Concepts

### Check Encryption at Rest

```bash
# Verify encryption configuration exists
ps aux | grep kube-apiserver | grep encryption-provider-config

# Read encryption config (on control plane)
cat /etc/kubernetes/encryption-config.yaml

# Verify secrets are encrypted in etcd
ETCDCTL_API=3 etcdctl get /registry/secrets/default/my-secret \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key | hexdump -C | head
```

### Audit etcd TLS Configuration

```bash
# Check etcd peer TLS
ps aux | grep etcd | grep -o '\-\-peer-cert-file=[^ ]*'

# Verify client TLS
ps aux | grep etcd | grep -o '\-\-client-cert-auth'

# Check for insecure etcd listener
ss -tlnp | grep 2379
ss -tlnp | grep 2380
```

### Detect Exposed etcd Endpoints

```bash
# Check if etcd is bound to all interfaces
ps aux | grep etcd | grep -o '\-\-listen-client-urls=[^ ]*'

# Verify etcd is not accessible from pods
kubectl run etcd-test --rm -it --image=busybox --restart=Never -- \
  wget -qO- --timeout=3 https://ETCD_IP:2379/health 2>&1 || true
```

### etcd Backup Security

```bash
# Snapshot backup with TLS
ETCDCTL_API=3 etcdctl snapshot save /tmp/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Verify backup integrity
ETCDCTL_API=3 etcdctl snapshot status /tmp/etcd-backup.db --write-out=json
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/detecting-etcd-security-issues-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Etcd Security Issues Detection
id: 9200d669-08fc-4e50-aac1-a7d63248c0e0
status: experimental
description: Detects suspicious activity related to detecting etcd security issues techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1552.007
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Etcd Security Issues Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1552.007 |

## Verification

- [ ] Encryption at rest enabled with aescbc or aesgcm provider
- [ ] etcd peer and client TLS enforced with valid certificates
- [ ] Client certificate authentication enabled
- [ ] etcd bound to localhost or control plane network only
- [ ] NetworkPolicy blocks pod-to-etcd communication
- [ ] Backups encrypted and stored with restricted access

## References

- [Kubernetes Encrypting Secret Data at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)
- [etcd Security Model](https://etcd.io/docs/v3.5/op-guide/security/)
- [CIS Kubernetes Benchmark — etcd](https://www.cisecurity.org/benchmark/kubernetes)
- [MITRE ATT&CK T1552.007 — Container API](https://attack.mitre.org/techniques/T1552/007/)
