Kubernetes Privileged Pod & Container Escape (Management Plane)

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•2

Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes configurations such as hostNetwork enabled, allowPrivilegeEscalation set to true, or running as root (runAsUser = 0). The rule specifically monitors 'io.k8s.core.v1.pods.create' operations in cloud audit logs.