Kubernetes Audit: Pod Creation in kube-system Namespace

Flags Kubernetes audit events creating pods in the kube-system namespace, a common place to camouflage malicious workloads.

FreeReviewedSigma · Medium · v5

Product: kubernetes
Category: application
Author: Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
Published: 2024-03-26
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.005Match Legitimate Resource Name or Location
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies Kubernetes API audit events where a pod is created in the kube-system namespace. This matters because adversaries may try to blend malicious workloads in the same namespace as critical system components, potentially reducing suspicion. The rule relies on Kubernetes audit telemetry capturing create requests for pods scoped specifically to kube-system.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

Suspicious svchost.exe Execution From AppData Roaming Directory

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Malicious WezRat Persistence via Chrome Updater Run Key

Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory

Suspicious Execution of spools.exe from Public Directory

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

Kubernetes Audit: Pod Creation in kube-system Namespace

Pivot detection · T1036.005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

kubernetes-pod-creation-in-kube-system-namespace-via-api-audit-logs-a80d927d

title: "Kubernetes Audit: Pod Creation in kube-system Namespace"
id: 060940cc-5c16-476a-a619-09f38f4acdd5
status: test
description: Identifies Kubernetes API audit events where a pod is created in the kube-system namespace. This matters because adversaries may try to blend malicious workloads in the same namespace as critical system components, potentially reducing suspicion. The rule relies on Kubernetes audit telemetry capturing create requests for pods scoped specifically to kube-system.
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: create
    objectRef.resource: pods
    objectRef.namespace: kube-system
  condition: selection
falsepositives:
  - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace
level: medium
license: DRL-1.1
related:
  - id: a80d927d-ac6e-443f-a867-e8d6e3897318
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL