Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
3
2
1
1
Platforms
3
2
Products / Services
3
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes pods configured with hostNetwork enabled, allowing privilege escalation, running as root (UID 0), or abusing capabilities.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
The analytic detects the creation of Kubernetes pods in the default, kube-system, or kube-public namespaces. It leverages Kubernetes audit logs to identify pod creation events within these specific namespaces. This activity is significant for a SOC as it may indicate an attacker attempting to hide their presence or evade defenses. Unauthorized pod creation in these namespaces can suggest a successful cluster breach, potentially leading to privilege escalation, persistent access, or further malicious activities within the cluster.
