Kubernetes Privileged Pod Created

 1[metadata]
 2creation_date = "2022/07/05"
 3integration = ["kubernetes"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects when a user creates a pod/container running in privileged mode. A highly privileged container has
11access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the
12privileged container to gain access to the underlying host. Gaining access to the host may provide the adversary with
13the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the
14environment, or setting up a command and control channel on the host.
15"""
16false_positives = [
17    """
18    By default a container is not allowed to access any devices on the host, but a "privileged" container is given
19    access to all devices on the host. This allows the container nearly all the same access as processes running on the
20    host. An administrator may want to run a privileged container to use operating system administrative capabilities
21    such as manipulating the network stack or accessing hardware devices from within the cluster. Add exceptions for
22    trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
23    """,
24]
25index = ["logs-kubernetes.*"]
26language = "kuery"
27license = "Elastic License v2"
28name = "Kubernetes Privileged Pod Created"
29note = """## Setup
30
31The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
32references = [
33    "https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF",
34    "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
35]
36risk_score = 47
37rule_id = "c7908cac-337a-4f38-b50d-5eeb78bdb531"
38severity = "medium"
39tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Privilege Escalation"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset : "kubernetes.audit_logs"
45  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
46  and kubernetes.audit.objectRef.resource:pods
47  and kubernetes.audit.verb:create
48  and kubernetes.audit.requestObject.spec.containers.securityContext.privileged:true
49  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
50'''
51
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1611"
57name = "Escape to Host"
58reference = "https://attack.mitre.org/techniques/T1611/"
59
60
61[rule.threat.tactic]
62id = "TA0004"
63name = "Privilege Escalation"
64reference = "https://attack.mitre.org/tactics/TA0004/"
65[[rule.threat]]
66framework = "MITRE ATT&CK"
67[[rule.threat.technique]]
68id = "T1610"
69name = "Deploy Container"
70reference = "https://attack.mitre.org/techniques/T1610/"
71
72
73[rule.threat.tactic]
74id = "TA0002"
75name = "Execution"
76reference = "https://attack.mitre.org/tactics/TA0002/"