Kubernetes: Privileged Pod Created via API Server Audit Logs

title: "Kubernetes: Privileged Pod Created via API Server Audit Logs"
id: c701fd66-ca82-47b1-87f7-f41a7931674e
status: test
description: This rule identifies Kubernetes pod creation events for pods where the container capabilities are set to all ("*"). Creating a privileged pod can enable an attacker to gain elevated access to host-level resources, increasing the likelihood of container escape or other privilege-escalation paths. It relies on Kubernetes API server audit log telemetry that records create operations on pods and the associated capabilities fields.
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
  - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer
  - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html
  - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1611
  - attack.privilege-escalation
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: create
    objectRef.resource: pods
    capabilities: "*"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: c5cd1b20-36bb-488d-8c05-486be3d0cb97
    type: derived