Kubernetes Pod Created With HostNetwork edit

This rules detects an attempt to create or modify a pod attached to the host network. HostNetwork allows a pod to use the node network namespace. Doing so gives the pod access to any service running on localhost of the host. An attacker could use this access to snoop on network activity of other pods on the same node or bypass restrictive network policies applied to its given namespace.

Rule type : query

Rule indices :

logs-kubernetes.*

Severity : medium

Risk score : 47

Runs every : 5m

Searches indices from : None ( Date Math format , see also Additional look-back time )

Maximum alerts per execution : 100

References :

https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces https://bishopfox.com/blog/kubernetes-pod-privilege-escalation

Tags :

Data Source: Kubernetes Tactic: Execution Tactic: Privilege Escalation

Version : 202

Rule authors :

Elastic

Rule license : Elastic License v2

Investigation guide edit

event.dataset : "kubernetes.audit_logs"
  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
  and kubernetes.audit.objectRef.resource:"pods"
  and kubernetes.audit.verb:("create" or "update" or "patch")
  and kubernetes.audit.requestObject.spec.hostNetwork:true
  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")

Framework : MITRE ATT&CK ^TM

Tactic:

Name: Privilege Escalation ID: TA0004 Reference URL: https://attack.mitre.org/tactics/TA0004/