Detection rules › By event

Kubernetes-pods

Event	Rules
get-pods	2
list-pods	3
watch-pods	1
create-pods	55
update-pods	24
patch-pods	20
get-pods-attach	2
create-pods-attach	4
update-pods-ephemeralcontainers	4
patch-pods-ephemeralcontainers	4
get-pods-exec	17
create-pods-exec	20
get-pods-log	1
get-pods-portforward	2
create-pods-portforward	2
any-pods	2

get-pods

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-pods

3 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

Splunk (1)

Amazon EKS Kubernetes Pod scan detection T1526

watch-pods

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-pods

55 detection rules reference this event. View event page.

Sigma (4)

Container With A hostPath Mount Created severity low T1611
Creation Of Pod In System Namespace severity medium T1036, T1036.005
GCP Break-glass Container Workload Deployed severity medium T1548
Privileged Container Deployed severity low T1611

Elastic (18)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Anonymous Pod Create/Update/Patch severity high T1610
GKE Container Created with Excessive Linux Capabilities severity medium T1610, T1611
GKE Pod Created with a Sensitive hostPath Volume severity medium T1610, T1611
GKE Pod Created With HostIPC severity medium T1610, T1611
GKE Pod Created With HostNetwork severity medium T1610, T1611
GKE Pod Created With HostPID severity medium T1610, T1611
GKE Privileged Pod Created severity medium T1610, T1611
GKE Suspicious Assignment of Controller Service Account severity medium T1078, T1078.001, T1610
Kubernetes Anonymous User Create/Update/Patch Pods Request severity medium T1610
Kubernetes Container Created with Excessive Linux Capabilities severity medium T1610, T1611
Kubernetes Pod Created with a Sensitive hostPath Volume severity medium T1610, T1611
Kubernetes Pod Created With HostIPC severity medium T1610, T1611
Kubernetes Pod Created With HostNetwork severity medium T1610, T1611
Kubernetes Pod Created With HostPID severity medium T1610, T1611
Kubernetes Pod Creation Using Common Debug or Base Images severity low building block T1609, T1610
Kubernetes Privileged Pod Created severity medium T1610, T1611
Kubernetes Suspicious Assignment of Controller Service Account severity medium T1078, T1078.001

Splunk (3)

Kubernetes Create or Update Privileged Pod severity low T1204
Kubernetes Pod Created in Default Namespace severity low T1204
Kubernetes Pod With Host Network Attachment severity low T1204

Panther (23)

GCP K8s Pod Attached To Node Host Network severity medium T1611
GCP K8S Pod Create Or Modify Host Path Volume Mount severity high T1041, T1611
GCP K8s Pod Using Host PID Namespace severity medium T1610, T1611
GCP K8S Privileged Pod Created severity high T1548
Kubernetes Pod Attached To Host Network severity medium T1611
Kubernetes Pod Created in System Namespace severity medium T1525, T1578.002, T1611
Kubernetes Pod Using Host IPC Namespace severity medium T1611, T1685
Kubernetes Pod Using Host PID Namespace severity medium T1610, T1611
Kubernetes Pod with Dangerous Linux Capabilities severity high T1068, T1611
Kubernetes Pod With HostPath Volume Mount severity medium T1041, T1611
Kubernetes Privileged Pod Created severity high T1548.003
Pod attached to the Node Host Network severity medium
Pod attached to the Node Host Network
Pod Created or Modified Using the Host IPC Namespace severity medium
Pod Created or Modified Using the Host IPC Namespace
Pod Created or Modified Using the Host PID Namespace severity medium
Pod Created or Modified Using the Host PID Namespace
Pod Created with Overly Permissive Linux Capabilities severity medium
Pod Created with Overly Permissive Linux Capabilities
Pod creation or modification to a Host Path Volume Mount severity medium
Pod creation or modification to a Host Path Volume Mount
Privileged Pod Created severity medium
Privileged Pod Created

Falco (7)

Create Disallowed Pod severity WARNING
Create HostIPC Pod severity WARNING
Create HostNetwork Pod severity WARNING
Create HostPid Pod severity WARNING
Create Privileged Pod severity WARNING
Create Sensitive Mount Pod severity WARNING
Pod Created in Kube Namespace severity WARNING

update-pods

24 detection rules reference this event. View event page.

Elastic (11)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Anonymous Pod Create/Update/Patch severity high T1610
GKE Pod Created with a Sensitive hostPath Volume severity medium T1610, T1611
GKE Pod Created With HostIPC severity medium T1610, T1611
GKE Pod Created With HostNetwork severity medium T1610, T1611
GKE Pod Created With HostPID severity medium T1610, T1611
Kubernetes Anonymous User Create/Update/Patch Pods Request severity medium T1610
Kubernetes Pod Created with a Sensitive hostPath Volume severity medium T1610, T1611
Kubernetes Pod Created With HostIPC severity medium T1610, T1611
Kubernetes Pod Created With HostNetwork severity medium T1610, T1611
Kubernetes Pod Created With HostPID severity medium T1610, T1611

Splunk (2)

Kubernetes Create or Update Privileged Pod severity low T1204
Kubernetes Pod With Host Network Attachment severity low T1204

Panther (11)

GCP K8s Pod Attached To Node Host Network severity medium T1611
GCP K8S Pod Create Or Modify Host Path Volume Mount severity high T1041, T1611
GCP K8s Pod Using Host PID Namespace severity medium T1610, T1611
Pod Created or Modified Using the Host IPC Namespace severity medium
Pod Created or Modified Using the Host IPC Namespace
Pod Created or Modified Using the Host PID Namespace severity medium
Pod Created or Modified Using the Host PID Namespace
Pod Created with Overly Permissive Linux Capabilities severity medium
Pod Created with Overly Permissive Linux Capabilities
Pod creation or modification to a Host Path Volume Mount severity medium
Pod creation or modification to a Host Path Volume Mount

patch-pods

20 detection rules reference this event. View event page.

Elastic (11)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Anonymous Pod Create/Update/Patch severity high T1610
GKE Pod Created with a Sensitive hostPath Volume severity medium T1610, T1611
GKE Pod Created With HostIPC severity medium T1610, T1611
GKE Pod Created With HostNetwork severity medium T1610, T1611
GKE Pod Created With HostPID severity medium T1610, T1611
Kubernetes Anonymous User Create/Update/Patch Pods Request severity medium T1610
Kubernetes Pod Created with a Sensitive hostPath Volume severity medium T1610, T1611
Kubernetes Pod Created With HostIPC severity medium T1610, T1611
Kubernetes Pod Created With HostNetwork severity medium T1610, T1611
Kubernetes Pod Created With HostPID severity medium T1610, T1611

Panther (9)

GCP K8s Pod Attached To Node Host Network severity medium T1611
GCP K8S Pod Create Or Modify Host Path Volume Mount severity high T1041, T1611
GCP K8s Pod Using Host PID Namespace severity medium T1610, T1611
Pod Created or Modified Using the Host IPC Namespace severity medium
Pod Created or Modified Using the Host IPC Namespace
Pod Created or Modified Using the Host PID Namespace severity medium
Pod Created or Modified Using the Host PID Namespace
Pod creation or modification to a Host Path Volume Mount severity medium
Pod creation or modification to a Host Path Volume Mount

get-pods-attach

2 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Falco (1)

Attach/Exec Pod severity NOTICE

create-pods-attach

4 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Panther (2)

Falco (1)

Attach/Exec Pod severity NOTICE

update-pods-ephemeralcontainers

4 detection rules reference this event. View event page.

Elastic (3)

Azure AKS Ephemeral Container Added to Pod severity medium T1610
GKE Ephemeral Container Added to Pod severity medium T1609, T1611
Kubernetes Ephemeral Container Added to Pod severity medium T1609, T1611

Falco (1)

EphemeralContainers Created severity NOTICE

patch-pods-ephemeralcontainers

4 detection rules reference this event. View event page.

Elastic (3)

Azure AKS Ephemeral Container Added to Pod severity medium T1610
GKE Ephemeral Container Added to Pod severity medium T1609, T1611
Kubernetes Ephemeral Container Added to Pod severity medium T1609, T1611

Falco (1)

EphemeralContainers Created severity NOTICE

get-pods-exec

17 detection rules reference this event. View event page.

Elastic (12)

Azure AKS Attempted User Exec into Pod severity medium T1609
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Pod Exec Cloud Instance Metadata Access severity high T1552, T1552.005, T1609
GKE Pod Exec Potential Reverse Shell severity high T1059, T1095, T1609
GKE Pod Exec Sensitive File or Credential Path Access severity high T1552, T1552.001, T1552.007, T1609
GKE Pod Exec with Curl or Wget to HTTPS severity high T1105, T1609
GKE User Exec into Pod severity medium T1609
Kubernetes Pod Exec Cloud Instance Metadata Access severity high T1552, T1552.005, T1609
Kubernetes Pod Exec Potential Reverse Shell severity high T1059, T1609
Kubernetes Pod Exec Sensitive File or Credential Path Access severity high T1552, T1552.001, T1552.007, T1609
Kubernetes Pod Exec with Curl or Wget to HTTPS severity high T1105, T1609
Kubernetes User Exec into Pod severity medium T1609

Panther (4)

Kubernetes Data Copy via kubectl cp severity medium T1530, T1552
Kubernetes Exec Into Pod severity medium
Unauthorized Kubernetes Pod Execution severity medium
Unauthorized Kubernetes Pod Execution

Falco (1)

Attach/Exec Pod severity NOTICE

create-pods-exec

20 detection rules reference this event. View event page.

Sigma (1)

Potential Remote Command Execution In Pod Container severity medium T1609

Elastic (12)

Azure AKS Attempted User Exec into Pod severity medium T1609
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Pod Exec Cloud Instance Metadata Access severity high T1552, T1552.005, T1609
GKE Pod Exec Potential Reverse Shell severity high T1059, T1095, T1609
GKE Pod Exec Sensitive File or Credential Path Access severity high T1552, T1552.001, T1552.007, T1609
GKE Pod Exec with Curl or Wget to HTTPS severity high T1105, T1609
GKE User Exec into Pod severity medium T1609
Kubernetes Pod Exec Cloud Instance Metadata Access severity high T1552, T1552.005, T1609
Kubernetes Pod Exec Potential Reverse Shell severity high T1059, T1609
Kubernetes Pod Exec Sensitive File or Credential Path Access severity high T1552, T1552.001, T1552.007, T1609
Kubernetes Pod Exec with Curl or Wget to HTTPS severity high T1105, T1609
Kubernetes User Exec into Pod severity medium T1609

Panther (6)

Exec into Pod severity medium
Kubernetes Data Copy via kubectl cp severity medium T1530, T1552
Kubernetes Exec Into Pod severity medium
Kubernetes Service Account Token Theft from Pod severity high T1078.004, T1550.001, T1552.007
Unauthorized Kubernetes Pod Execution severity medium
Unauthorized Kubernetes Pod Execution

Falco (1)

Attach/Exec Pod severity NOTICE

get-pods-log

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

get-pods-portforward

2 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Falco (1)

port-forward severity NOTICE

create-pods-portforward

2 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Falco (1)

port-forward severity NOTICE

any-pods

2 detection rules reference this event. View event page.

Elastic (2)

Kubernetes Multi-Resource Discovery severity medium T1613
Kubernetes Unusual Decision by User Agent severity low T1078