Kubernetes Pod Created With HostNetwork

 1[metadata]
 2creation_date = "2022/07/05"
 3integration = ["kubernetes"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rules detects an attempt to create or modify a pod attached to the host network. HostNetwork allows a pod to use
11the node network namespace. Doing so gives the pod access to any service running on localhost of the host. An attacker
12could use this access to snoop on network activity of other pods on the same node or bypass restrictive network policies
13applied to its given namespace.
14"""
15false_positives = [
16    """
17    An administrator or developer may want to use a pod that runs as root and shares the hosts IPC, Network, and PID
18    namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto
19    the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and
20    network namespaces from the host's perspective. Add exceptions for trusted container images using the query field
21    "kubernetes.audit.requestObject.spec.container.image"
22    """,
23]
24index = ["logs-kubernetes.*"]
25language = "kuery"
26license = "Elastic License v2"
27name = "Kubernetes Pod Created With HostNetwork"
28note = """## Setup
29
30The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
31references = [
32    "https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections",
33    "https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces",
34    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
35]
36risk_score = 47
37rule_id = "12cbf709-69e8-4055-94f9-24314385c27e"
38severity = "medium"
39tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Privilege Escalation"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset : "kubernetes.audit_logs"
45  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
46  and kubernetes.audit.objectRef.resource:"pods"
47  and kubernetes.audit.verb:("create" or "update" or "patch")
48  and kubernetes.audit.requestObject.spec.hostNetwork:true
49  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
50'''
51
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1611"
57name = "Escape to Host"
58reference = "https://attack.mitre.org/techniques/T1611/"
59
60
61[rule.threat.tactic]
62id = "TA0004"
63name = "Privilege Escalation"
64reference = "https://attack.mitre.org/tactics/TA0004/"
65[[rule.threat]]
66framework = "MITRE ATT&CK"
67[[rule.threat.technique]]
68id = "T1610"
69name = "Deploy Container"
70reference = "https://attack.mitre.org/techniques/T1610/"
71
72
73[rule.threat.tactic]
74id = "TA0002"
75name = "Execution"
76reference = "https://attack.mitre.org/tactics/TA0002/"