Kubernetes Pod Created With hostPath Volume Mount
Alerts on Kubernetes pod creation requests that include a hostPath volume mount.
- Product
- kubernetes
- Category
- application
- Author
- Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Kubernetes API audit events where a pod creation request includes a hostPath volume mount. hostPath mounts map a directory or file from the node into the container, which can enable interaction with node filesystem content. The detection relies on Kubernetes audit log telemetry capturing pod creation operations and the presence of a hostPath field in the request payload.
Reporting behind it
- microsoft.github.iohttps://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
- blog.appsecco.comhttps://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Kubernetes Pod Created With hostPath Volume Mount
id: 3a904120-e175-4b16-b28f-355c49cb928a
status: test
description: This rule flags Kubernetes API audit events where a pod creation request includes a hostPath volume mount. hostPath mounts map a directory or file from the node into the container, which can enable interaction with node filesystem content. The detection relies on Kubernetes audit log telemetry capturing pod creation operations and the presence of a hostPath field in the request payload.
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
- attack.t1611
- attack.privilege-escalation
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: create
objectRef.resource: pods
hostPath: "*"
condition: selection
falsepositives:
- The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.
level: low
license: DRL-1.1
related:
- id: 402b955c-8fe0-4a8c-b635-622b4ac5f902
type: derived