A laptop-hosted kind cluster lab that runs real Kubernetes privilege paths and a six-hop intrusion chain, then collects audit-log and network-counter telemetry to evaluate Sigma detections and posture checks. The repository documents its coverage gaps and an outstanding failing assertion.
- ✓Three trust zones with default-deny network policies enforced by kube-router
- ✓Seven scripted privilege paths and a six-hop ATT&CK-mapped intrusion chain
- ✓Seven telemetry schemas, seven Sigma rules, and five live posture checks
- ✓Mutation checks challenge each detection rule; telemetry is linked to evidence
- ✓The README states current detection limits and one undiagnosed failing assertion
KuberneteskindPythonPowerShellSigmaMITRE ATT&CKDockerNetworkPolicy
DISCLAIMER - Authorized local lab use only. Scripts target a kind cluster named soc-lab via the active kubeconfig. The dashboard can mint a cluster-admin token and must remain bound to loopback.
How it works
- Build the clusterPowerShell bootstraps a local kind cluster and applies the lab workloads and trust boundaries.
- Run attack pathsScripts exercise documented privilege paths and a six-hop intrusion chain against the local cluster.
- Collect evidenceCollectors capture Kubernetes audit events and comparable network-counter measurements.
- Evaluate detectionsSigma and posture checks run against collected evidence; mutation checks test whether gates can fail.
LAB INVENTORY
| Component | Count |
|---|---|
| Trust zones | 3 |
| Workloads | 5 |
| Privilege paths | 7 |
| Intrusion chain | 6 hops |
| Telemetry schemas | 7 |
| Sigma rules / posture checks | 7 / 5 |
DOCUMENTED COVERAGE GAPS
From the repository README; these are stated limitations, not implied coverage.
| Area | Current limitation |
|---|---|
| Privilege-path assertions | One assertion currently fails and is undiagnosed. |
| T1021 | No positive attack-step test; current hits are instrumentation. |
| T1190 | Listed in the technique catalogue but not detected from collected schemas. |
| Network telemetry | Counter deltas do not provide destination and port flow details. |
RUN THE LOCAL LAB
powershell
git clone https://github.com/dhanushbs10/zerotrust-soc-lab.git cd zerotrust-soc-lab powershell -File run-lab.ps1 python dashboard\server.py
—Prerequisites: Docker Desktop with WSL2 and 40 GB free, kind, kubectl, Python 3.11+
—Clone the repository and run powershell -File run-lab.ps1
—Start the console with python dashboard\server.py
—Open http://127.0.0.1:8099; the console binds to loopback only
—Read docs/HOW-IT-WORKS.md and the README limitations before interpreting results