Kubernetes Container Created With HostPath Mount

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•22

This rule detects the creation of a Kubernetes container that includes a hostPath mount. A hostPath volume allows a directory or file from the node to be mounted directly into the container. Attackers with permissions to create pods can leverage writable hostPath volumes to perform container escapes, potentially gaining access to the underlying host node by using techniques like chroot.