Kubernetes Pod Created With HostIPC

 1[metadata]
 2creation_date = "2022/07/05"
 3integration = ["kubernetes"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects an attempt to create or modify a pod using the host IPC namespace. This gives access to data used by
11any pod that also use the hosts IPC namespace. If any process on the host or any processes in a pod uses the hosts
12inter-process communication mechanisms (shared memory, semaphore arrays, message queues, etc.), an attacker can
13read/write to those same mechanisms. They may look for files in /dev/shm or use ipcs to check for any IPC facilities
14being used.
15"""
16false_positives = [
17    """
18    An administrator or developer may want to use a pod that runs as root and shares the host's IPC, Network, and PID
19    namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto
20    the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and
21    network namespaces from the host's perspective. Add exceptions for trusted container images using the query field
22    "kubernetes.audit.requestObject.spec.container.image"
23    """,
24]
25index = ["logs-kubernetes.*"]
26language = "kuery"
27license = "Elastic License v2"
28name = "Kubernetes Pod Created With HostIPC"
29note = """## Setup
30
31The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
32references = [
33    "https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections",
34    "https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces",
35    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
36]
37risk_score = 47
38rule_id = "764c8437-a581-4537-8060-1fdb0e92c92d"
39severity = "medium"
40tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Privilege Escalation"]
41timestamp_override = "event.ingested"
42type = "query"
43
44query = '''
45event.dataset : "kubernetes.audit_logs"
46  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
47  and kubernetes.audit.objectRef.resource:"pods"
48  and kubernetes.audit.verb:("create" or "update" or "patch")
49  and kubernetes.audit.requestObject.spec.hostIPC:true
50  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
51'''
52
53
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1611"
58name = "Escape to Host"
59reference = "https://attack.mitre.org/techniques/T1611/"
60
61
62[rule.threat.tactic]
63id = "TA0004"
64name = "Privilege Escalation"
65reference = "https://attack.mitre.org/tactics/TA0004/"
66[[rule.threat]]
67framework = "MITRE ATT&CK"
68[[rule.threat.technique]]
69id = "T1610"
70name = "Deploy Container"
71reference = "https://attack.mitre.org/techniques/T1610/"
72
73
74[rule.threat.tactic]
75id = "TA0002"
76name = "Execution"
77reference = "https://attack.mitre.org/tactics/TA0002/"