Kubernetes Pod Created With HostNetwork

 1[metadata]
 2creation_date = "2022/07/05"
 3integration = ["kubernetes"]
 4maturity = "production"
 5min_stack_comments = "New fields added to Kubernetes Integration"
 6min_stack_version = "8.4.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12This rules detects an attempt to create or modify a pod attached to the host network. HostNetwork allows a pod to use
13the node network namespace. Doing so gives the pod access to any service running on localhost of the host. An attacker
14could use this access to snoop on network activity of other pods on the same node or bypass restrictive network policies
15applied to its given namespace.
16"""
17false_positives = [
18    """
19    An administrator or developer may want to use a pod that runs as root and shares the hosts IPC, Network, and PID
20    namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto
21    the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and
22    network namespaces from the host's perspective. Add exceptions for trusted container images using the query field
23    "kubernetes.audit.requestObject.spec.container.image"
24    """,
25]
26index = ["logs-kubernetes.*"]
27language = "kuery"
28license = "Elastic License v2"
29name = "Kubernetes Pod Created With HostNetwork"
30note = """## Setup
31
32The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
33references = [
34    "https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections",
35    "https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces",
36    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
37]
38risk_score = 47
39rule_id = "12cbf709-69e8-4055-94f9-24314385c27e"
40severity = "medium"
41tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Privilege Escalation"]
42timestamp_override = "event.ingested"
43type = "query"
44
45query = '''
46event.dataset : "kubernetes.audit_logs"
47  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
48  and kubernetes.audit.objectRef.resource:"pods"
49  and kubernetes.audit.verb:("create" or "update" or "patch")
50  and kubernetes.audit.requestObject.spec.hostNetwork:true
51  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
52'''
53
54
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1611"
59name = "Escape to Host"
60reference = "https://attack.mitre.org/techniques/T1611/"
61
62
63[rule.threat.tactic]
64id = "TA0004"
65name = "Privilege Escalation"
66reference = "https://attack.mitre.org/tactics/TA0004/"
67[[rule.threat]]
68framework = "MITRE ATT&CK"
69[[rule.threat.technique]]
70id = "T1610"
71name = "Deploy Container"
72reference = "https://attack.mitre.org/techniques/T1610/"
73
74
75[rule.threat.tactic]
76id = "TA0002"
77name = "Execution"
78reference = "https://attack.mitre.org/tactics/TA0002/"