GKE Pod Created With HostPID

  1[metadata]
  2creation_date = "2026/06/30"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects GKE pod create, update, or patch events that enable host PID namespace sharing. HostPID exposes host processes
 11and can support privilege escalation, especially with ptrace or privileged containers. System identities and
 12controller-owned workloads are excluded.
 13"""
 14false_positives = [
 15    """
 16    Debug pods may legitimately use hostPID. Exclude trusted admin workflows after baselining.
 17    """,
 18]
 19index = ["logs-gcp.audit-*"]
 20language = "kuery"
 21license = "Elastic License v2"
 22name = "GKE Pod Created With HostPID"
 23note = """## Triage and analysis
 24
 25### Investigating GKE Pod Created With HostPID
 26
 27HostPID visibility into host processes is high risk. Confirm whether the pod spec change was authorized.
 28
 29### Investigation steps
 30
 31- Review actor (`user.email`), target pod, and images in the audit request.
 32- Correlate with exec, secret access, or RBAC changes from the same identity.
 33
 34### False positives
 35
 36- Break-glass troubleshooting; tune by user or namespace.
 37
 38## Setup
 39
 40The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
 41references = [
 42    "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
 43    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
 44]
 45risk_score = 47
 46rule_id = "f2108687-553d-45ac-b8f0-d0efeac5d45f"
 47severity = "medium"
 48tags = [
 49    "Domain: Cloud",
 50    "Domain: Kubernetes",
 51    "Data Source: GCP",
 52    "Data Source: Google Cloud Platform",
 53    "Use Case: Threat Detection",
 54    "Tactic: Privilege Escalation",
 55    "Tactic: Execution",
 56    "Resources: Investigation Guide",
 57    "Noise: Unknown",
 58    "Performance: Fast",
 59    "Profile: Recommended",
 60    "Threat: Container Escape",
 61    "Rule Type: Custom Query (KQL)",
 62    "Platform: GCP",
 63    "Domain: Containers",
 64    "Platform: Kubernetes",
 65]
 66timestamp_override = "event.ingested"
 67type = "query"
 68
 69query = '''
 70data_stream.dataset:gcp.audit and
 71event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
 72gcp.audit.request.spec.hostPID:true and not user.email:system\:* and
 73not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")
 74'''
 75
 76[[rule.threat]]
 77framework = "MITRE ATT&CK"
 78
 79[[rule.threat.technique]]
 80id = "T1611"
 81name = "Escape to Host"
 82reference = "https://attack.mitre.org/techniques/T1611/"
 83
 84[rule.threat.tactic]
 85id = "TA0004"
 86name = "Privilege Escalation"
 87reference = "https://attack.mitre.org/tactics/TA0004/"
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91
 92[[rule.threat.technique]]
 93id = "T1610"
 94name = "Deploy Container"
 95reference = "https://attack.mitre.org/techniques/T1610/"
 96
 97[rule.threat.tactic]
 98id = "TA0002"
 99name = "Execution"
100reference = "https://attack.mitre.org/tactics/TA0002/"