huntrule

Kubernetes Audit: Pod Creation in kube-system Namespace

Flags Kubernetes audit events creating pods in the kube-system namespace, a common place to camouflage malicious workloads.

FreeReviewedSigma · Medium · v5
Product
kubernetes
Category
application
Author
Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
Published
2024-03-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies Kubernetes API audit events where a pod is created in the kube-system namespace. This matters because adversaries may try to blend malicious workloads in the same namespace as critical system components, potentially reducing suspicion. The rule relies on Kubernetes audit telemetry capturing create requests for pods scoped specifically to kube-system.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)
Suspicious Axios NPM macOS Persistence Masquerading as Apple Service
Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)
Suspicious svchost.exe Execution From AppData Roaming Directory
Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)
Malicious WezRat Persistence via Chrome Updater Run Key
Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory
Suspicious Execution of spools.exe from Public Directory
Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)
Kubernetes Audit: Pod Creation in kube-system Namespace
Pivot detection · T1036.005 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.