Detection rules › Falco
Create HostNetwork Pod
Detect an attempt to start a pod using the host network.
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-pods: create pods |
Rules detecting the same action
These rules filter on the same operation.
- Attach/Exec Pod (Falco)
- Azure AKS Attempted User Exec into Pod (Elastic)
- Container With A hostPath Mount Created (Sigma)
- Create Disallowed Pod (Falco)
- Create HostIPC Pod (Falco)
- Create HostPid Pod (Falco)
- Create Privileged Pod (Falco)
- Create Sensitive Mount Pod (Falco)
Stages and Predicates
Stage 1: falco_condition
and
not
requestObject.pod.containers.image.repository in ["gcr.io/gke-release/cnrm/recorder", "gcr.io/google-containers/prometheus-to-sd", "gcr.io/projectcalico-org/node", "gcr.io/projectcalico-org/typha", "gke.gcr.io/csi-node-driver-registrar", "gke.gcr.io/fluent-bit", "gke.gcr.io/fluent-bit-gke-exporter", "gke.gcr.io/gcp-compute-persistent-disk-csi-driver", "gke.gcr.io/gke-metadata-server", "gke.gcr.io/gke-metrics-agent", "gke.gcr.io/k8s-dns-node-cache", "gke.gcr.io/kube-proxy", "gke.gcr.io/kube-proxy-amd64", "gke.gcr.io/netd", "gke.gcr.io/netd-amd64", "gke.gcr.io/proxy-agent", "k8s.gcr.io/prometheus-to-sd", "registry.k8s.io/ip-masq-agent-amd64", "registry.k8s.io/prometheus-to-sd"]
objectRef.resource eq "pods"
objectRef.subresource is_null
requestObject.pod.host_network eq "true"
stage eq "ResponseComplete"
verb eq "create"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
requestObject.pod.containers.image.repository | in | gcr.io/gke-release/cnrm/recorder, gcr.io/google-containers/prometheus-to-sd, gcr.io/projectcalico-org/node, gcr.io/projectcalico-org/typha, gke.gcr.io/csi-node-driver-registrar, gke.gcr.io/fluent-bit, gke.gcr.io/fluent-bit-gke-exporter, gke.gcr.io/gcp-compute-persistent-disk-csi-driver, gke.gcr.io/gke-metadata-server, gke.gcr.io/gke-metrics-agent, gke.gcr.io/k8s-dns-node-cache, gke.gcr.io/kube-proxy, gke.gcr.io/kube-proxy-amd64, gke.gcr.io/netd, gke.gcr.io/netd-amd64, gke.gcr.io/proxy-agent, k8s.gcr.io/prometheus-to-sd, registry.k8s.io/ip-masq-agent-amd64, registry.k8s.io/prometheus-to-sd | excludes:requestObject.pod.containers.image.repository |
Indicators
These rows show field, operator, and value matches.