Detection rules › Falco

Create HostNetwork Pod

Severity
WARNING
Source
k8saudit

Detect an attempt to start a pod using the host network.

Telemetry coverage

PlatformRecord / event type
Kubernetescreate-pods: create pods

Rules detecting the same action

These rules filter on the same operation.

Stages and Predicates

Stage 1: falco_condition

and
  not
    requestObject.pod.containers.image.repository in ["gcr.io/gke-release/cnrm/recorder", "gcr.io/google-containers/prometheus-to-sd", "gcr.io/projectcalico-org/node", "gcr.io/projectcalico-org/typha", "gke.gcr.io/csi-node-driver-registrar", "gke.gcr.io/fluent-bit", "gke.gcr.io/fluent-bit-gke-exporter", "gke.gcr.io/gcp-compute-persistent-disk-csi-driver", "gke.gcr.io/gke-metadata-server", "gke.gcr.io/gke-metrics-agent", "gke.gcr.io/k8s-dns-node-cache", "gke.gcr.io/kube-proxy", "gke.gcr.io/kube-proxy-amd64", "gke.gcr.io/netd", "gke.gcr.io/netd-amd64", "gke.gcr.io/proxy-agent", "k8s.gcr.io/prometheus-to-sd", "registry.k8s.io/ip-masq-agent-amd64", "registry.k8s.io/prometheus-to-sd"]
  objectRef.resource eq "pods"
  objectRef.subresource is_null
  requestObject.pod.host_network eq "true"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
requestObject.pod.containers.image.repositoryingcr.io/gke-release/cnrm/recorder, gcr.io/google-containers/prometheus-to-sd, gcr.io/projectcalico-org/node, gcr.io/projectcalico-org/typha, gke.gcr.io/csi-node-driver-registrar, gke.gcr.io/fluent-bit, gke.gcr.io/fluent-bit-gke-exporter, gke.gcr.io/gcp-compute-persistent-disk-csi-driver, gke.gcr.io/gke-metadata-server, gke.gcr.io/gke-metrics-agent, gke.gcr.io/k8s-dns-node-cache, gke.gcr.io/kube-proxy, gke.gcr.io/kube-proxy-amd64, gke.gcr.io/netd, gke.gcr.io/netd-amd64, gke.gcr.io/proxy-agent, k8s.gcr.io/prometheus-to-sd, registry.k8s.io/ip-masq-agent-amd64, registry.k8s.io/prometheus-to-sdexcludes:requestObject.pod.containers.image.repository

Indicators

These rows show field, operator, and value matches.