Malicious Pod Deployed via Kubernetes API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•10

This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.