Kubernetes Pod Created With HostIPC

 1[metadata]
 2creation_date = "2022/07/05"
 3integration = ["kubernetes"]
 4maturity = "production"
 5min_stack_comments = "New fields added to Kubernetes Integration"
 6min_stack_version = "8.4.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12This rule detects an attempt to create or modify a pod using the host IPC namespace. This gives access to data used by
13any pod that also use the hosts IPC namespace. If any process on the host or any processes in a pod uses the hosts
14inter-process communication mechanisms (shared memory, semaphore arrays, message queues, etc.), an attacker can
15read/write to those same mechanisms. They may look for files in /dev/shm or use ipcs to check for any IPC facilities
16being used.
17"""
18false_positives = [
19    """
20    An administrator or developer may want to use a pod that runs as root and shares the host's IPC, Network, and PID
21    namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto
22    the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and
23    network namespaces from the host's perspective. Add exceptions for trusted container images using the query field
24    "kubernetes.audit.requestObject.spec.container.image"
25    """,
26]
27index = ["logs-kubernetes.*"]
28language = "kuery"
29license = "Elastic License v2"
30name = "Kubernetes Pod Created With HostIPC"
31note = """## Setup
32
33The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
34references = [
35    "https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections",
36    "https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces",
37    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
38]
39risk_score = 47
40rule_id = "764c8437-a581-4537-8060-1fdb0e92c92d"
41severity = "medium"
42tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Privilege Escalation"]
43timestamp_override = "event.ingested"
44type = "query"
45
46query = '''
47event.dataset : "kubernetes.audit_logs"
48  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
49  and kubernetes.audit.objectRef.resource:"pods"
50  and kubernetes.audit.verb:("create" or "update" or "patch")
51  and kubernetes.audit.requestObject.spec.hostIPC:true
52  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
53'''
54
55
56[[rule.threat]]
57framework = "MITRE ATT&CK"
58[[rule.threat.technique]]
59id = "T1611"
60name = "Escape to Host"
61reference = "https://attack.mitre.org/techniques/T1611/"
62
63
64[rule.threat.tactic]
65id = "TA0004"
66name = "Privilege Escalation"
67reference = "https://attack.mitre.org/tactics/TA0004/"
68[[rule.threat]]
69framework = "MITRE ATT&CK"
70[[rule.threat.technique]]
71id = "T1610"
72name = "Deploy Container"
73reference = "https://attack.mitre.org/techniques/T1610/"
74
75
76[rule.threat.tactic]
77id = "TA0002"
78name = "Execution"
79reference = "https://attack.mitre.org/tactics/TA0002/"