Kubernetes Pod Creation via API with curl

Brandon Rodriguez@BMRodriguez

•updated Jun 1, 2026•3•0•6

Identifies the use of curl to send POST requests to the Kubernetes API targeting the creation of pods. This can indicate an attacker using a stolen ServiceAccount token to deploy malicious or privileged containers.