Kubernetes Privileged Pod Created

 1[metadata]
 2creation_date = "2022/07/05"
 3integration = ["kubernetes"]
 4maturity = "production"
 5min_stack_comments = "New fields added to Kubernetes Integration"
 6min_stack_version = "8.4.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12This rule detects when a user creates a pod/container running in privileged mode. A highly privileged container has
13access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the
14privileged container to gain access to the underlying host. Gaining access to the host may provide the adversary with
15the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the
16environment, or setting up a command and control channel on the host.
17"""
18false_positives = [
19    """
20    By default a container is not allowed to access any devices on the host, but a "privileged" container is given
21    access to all devices on the host. This allows the container nearly all the same access as processes running on the
22    host. An administrator may want to run a privileged container to use operating system administrative capabilities
23    such as manipulating the network stack or accessing hardware devices from within the cluster. Add exceptions for
24    trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
25    """,
26]
27index = ["logs-kubernetes.*"]
28language = "kuery"
29license = "Elastic License v2"
30name = "Kubernetes Privileged Pod Created"
31note = """## Setup
32
33The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
34references = [
35    "https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF",
36    "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
37]
38risk_score = 47
39rule_id = "c7908cac-337a-4f38-b50d-5eeb78bdb531"
40severity = "medium"
41tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Privilege Escalation"]
42timestamp_override = "event.ingested"
43type = "query"
44
45query = '''
46event.dataset : "kubernetes.audit_logs"
47  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
48  and kubernetes.audit.objectRef.resource:pods
49  and kubernetes.audit.verb:create
50  and kubernetes.audit.requestObject.spec.containers.securityContext.privileged:true
51  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
52'''
53
54
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1611"
59name = "Escape to Host"
60reference = "https://attack.mitre.org/techniques/T1611/"
61
62
63[rule.threat.tactic]
64id = "TA0004"
65name = "Privilege Escalation"
66reference = "https://attack.mitre.org/tactics/TA0004/"
67[[rule.threat]]
68framework = "MITRE ATT&CK"
69[[rule.threat.technique]]
70id = "T1610"
71name = "Deploy Container"
72reference = "https://attack.mitre.org/techniques/T1610/"
73
74
75[rule.threat.tactic]
76id = "TA0002"
77name = "Execution"
78reference = "https://attack.mitre.org/tactics/TA0002/"