Kubernetes Pod Creation in Kube Namespace by Non-System Account

Garyson Pereira@GaryPereira26

•updated Aug 1, 2025•3•0•116

This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.