Detection rules › Falco
Create HostPid Pod
Detect an attempt to start a pod using the host pid namespace.
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-pods: create pods |
Rules detecting the same action
These rules filter on the same operation.
- Attach/Exec Pod (Falco)
- Azure AKS Attempted User Exec into Pod (Elastic)
- Container With A hostPath Mount Created (Sigma)
- Create Disallowed Pod (Falco)
- Create HostIPC Pod (Falco)
- Create HostNetwork Pod (Falco)
- Create Privileged Pod (Falco)
- Create Sensitive Mount Pod (Falco)
Stages and Predicates
Stage 1: falco_condition
and
not
requestObject.pod.containers.image.repository in
objectRef.resource eq "pods"
objectRef.subresource is_null
requestObject.pod.host_pid eq "true"
stage eq "ResponseComplete"
verb eq "create"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
requestObject.pod.containers.image.repository | in | excludes:requestObject.pod.containers.image.repository |
Indicators
These rows show field, operator, and value matches.