GKE Container Created with Excessive Linux Capabilities

  1[metadata]
  2creation_date = "2026/06/30"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects GKE pod creation with dangerous Linux capabilities that are commonly abused in container escape techniques.
 11Standalone pods are included; controller-owned ReplicaSet, DaemonSet, and StatefulSet workloads are excluded.
 12"""
 13false_positives = [
 14    """
 15    Some platform or security images legitimately require elevated capabilities. Add image or namespace exceptions after
 16    review.
 17    """,
 18]
 19index = ["logs-gcp.audit-*"]
 20language = "kuery"
 21license = "Elastic License v2"
 22name = "GKE Container Created with Excessive Linux Capabilities"
 23note = """## Triage and analysis
 24
 25### Investigating GKE Container Created with Excessive Linux Capabilities
 26
 27Capabilities such as SYS_ADMIN, NET_ADMIN, and BPF can enable host escape. Review `gcp.audit.request.spec.containers`
 28and the creating identity.
 29
 30### Investigation steps
 31
 32- Confirm which capability was added and whether the image requires it.
 33- Review `user.email`, namespace, and follow-on API activity from the same actor.
 34
 35### False positives
 36
 37- Known DaemonSet or operator images may need capabilities; exclude after validation.
 38
 39## Setup
 40
 41The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
 42references = [
 43    "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container",
 44    "https://0xn3va.gitbook.io/cheat-sheets/container/escaping/excessive-capabilities",
 45]
 46risk_score = 47
 47rule_id = "a8a48752-58f3-43a9-beb5-14b9e9f6a8b0"
 48severity = "medium"
 49tags = [
 50    "Domain: Cloud",
 51    "Domain: Kubernetes",
 52    "Data Source: GCP",
 53    "Data Source: Google Cloud Platform",
 54    "Use Case: Threat Detection",
 55    "Tactic: Privilege Escalation",
 56    "Tactic: Execution",
 57    "Resources: Investigation Guide",
 58    "Noise: Medium",
 59    "Performance: Fast",
 60    "Profile: Recommended",
 61    "Threat: Container Escape",
 62    "Rule Type: Custom Query (KQL)",
 63    "Platform: GCP",
 64    "Domain: Containers",
 65    "Platform: Kubernetes",
 66]
 67timestamp_override = "event.ingested"
 68type = "query"
 69
 70query = '''
 71data_stream.dataset:gcp.audit and event.action:"io.k8s.core.v1.pods.create" and event.outcome:success and
 72gcp.audit.request.spec.containers.securityContext.capabilities.add:(
 73  "BPF" or "DAC_READ_SEARCH" or "NET_ADMIN" or "SYS_ADMIN" or "SYS_BOOT" or "SYS_MODULE" or "SYS_PTRACE" or "SYS_RAWIO" or
 74  "SYSLOG"
 75) and not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")
 76'''
 77
 78[[rule.threat]]
 79framework = "MITRE ATT&CK"
 80
 81[[rule.threat.technique]]
 82id = "T1611"
 83name = "Escape to Host"
 84reference = "https://attack.mitre.org/techniques/T1611/"
 85
 86[rule.threat.tactic]
 87id = "TA0004"
 88name = "Privilege Escalation"
 89reference = "https://attack.mitre.org/tactics/TA0004/"
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93
 94[[rule.threat.technique]]
 95id = "T1610"
 96name = "Deploy Container"
 97reference = "https://attack.mitre.org/techniques/T1610/"
 98
 99[rule.threat.tactic]
100id = "TA0002"
101name = "Execution"
102reference = "https://attack.mitre.org/tactics/TA0002/"