Kubernetes: Pod Creation in kube-system Namespace via API Audit Logs

Flags Kubernetes audit events creating pods in the kube-system namespace, a common place to camouflage malicious workloads.

FreeUnreviewedSigmamediumv1

kubernetes-pod-creation-in-kube-system-namespace-via-api-audit-logs-a80d927d

title: "Kubernetes: Pod Creation in kube-system Namespace via API Audit Logs"
id: 060940cc-5c16-476a-a619-09f38f4acdd5
status: test
description: This rule matches Kubernetes API audit events where a pod is created in the kube-system namespace. Creating pods in this highly privileged namespace can help attackers blend in with legitimate system workloads, including by using names similar to expected system components. The detection relies on audit log telemetry indicating the create verb and the target pod resource in the kube-system namespace.
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: create
    objectRef.resource: pods
    objectRef.namespace: kube-system
  condition: selection
falsepositives:
  - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace
level: medium
license: DRL-1.1
related:
  - id: a80d927d-ac6e-443f-a867-e8d6e3897318
    type: derived

What it detects

This rule matches Kubernetes API audit events where a pod is created in the kube-system namespace. Creating pods in this highly privileged namespace can help attackers blend in with legitimate system workloads, including by using names similar to expected system components. The detection relies on audit log telemetry indicating the create verb and the target pod resource in the kube-system namespace.

Known false positives

System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.