Creation Of Pod In Kube-System Namespace

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•22

Detects the creation of new pods within the `kube-system` namespace. This activity is suspicious because attackers might create pods with names similar to legitimate system components (e.g., `kube-proxy-bv61v`) to masquerade as system pods and evade detection. Legitimate system pods created by controllers typically have random suffixes in their names. This rule specifically looks for `create` operations on `pods` within the `kube-system` namespace.