Detection rules › Falco
Create Privileged Pod
Detect an attempt to start a pod with a privileged container
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-pods: create pods |
Rules detecting the same action
These rules filter on the same operation.
- Attach/Exec Pod (Falco)
- Azure AKS Attempted User Exec into Pod (Elastic)
- Container With A hostPath Mount Created (Sigma)
- Create Disallowed Pod (Falco)
- Create HostIPC Pod (Falco)
- Create HostNetwork Pod (Falco)
- Create HostPid Pod (Falco)
- Create Sensitive Mount Pod (Falco)
Stages and Predicates
Stage 1: falco_condition
and
not
requestObject.pod.containers.image.repository in ["calico/node", "docker.io/calico/node", "docker.io/cloudnativelabs/kube-router", "docker.io/docker/ucp-agent", "docker.io/falcosecurity/falco", "docker.io/mesosphere/mesos-slave", "docker.io/rook/toolbox", "docker.io/sysdig/sysdig", "falcosecurity/falco", "gcr.io/google-containers/prometheus-to-sd", "gcr.io/google-containers/startup-script", "gcr.io/google_containers/kube-proxy", "gcr.io/projectcalico-org/node", "gke.gcr.io/csi-node-driver-registrar", "gke.gcr.io/gcp-compute-persistent-disk-csi-driver", "gke.gcr.io/gke-metadata-server", "gke.gcr.io/k8s-dns-node-cache", "gke.gcr.io/kube-proxy", "gke.gcr.io/kube-proxy-amd64", "gke.gcr.io/netd", "gke.gcr.io/netd-amd64", "gke.gcr.io/watcher-daemonset", "mcr.microsoft.com/oss/kubernetes/kube-proxy", "public.ecr.aws/falcosecurity/falco", "quay.io/calico/node", "registry.k8s.io/dns/k8s-dns-node-cache", "registry.k8s.io/ip-masq-agent-amd64", "registry.k8s.io/kube-proxy", "registry.k8s.io/prometheus-to-sd", "sysdig/sysdig"]
or
requestObject.pod.containers.privileged eq "true"
requestObject.pod.ephemeralContainers.privileged eq "true"
requestObject.pod.initContainers.privileged eq "true"
objectRef.resource eq "pods"
objectRef.subresource is_null
stage eq "ResponseComplete"
verb eq "create"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
requestObject.pod.containers.image.repository | in | calico/node, docker.io/calico/node, docker.io/cloudnativelabs/kube-router, docker.io/docker/ucp-agent, docker.io/falcosecurity/falco, docker.io/mesosphere/mesos-slave, docker.io/rook/toolbox, docker.io/sysdig/sysdig, falcosecurity/falco, gcr.io/google-containers/prometheus-to-sd, gcr.io/google-containers/startup-script, gcr.io/google_containers/kube-proxy, gcr.io/projectcalico-org/node, gke.gcr.io/csi-node-driver-registrar, gke.gcr.io/gcp-compute-persistent-disk-csi-driver, gke.gcr.io/gke-metadata-server, gke.gcr.io/k8s-dns-node-cache, gke.gcr.io/kube-proxy, gke.gcr.io/kube-proxy-amd64, gke.gcr.io/netd, gke.gcr.io/netd-amd64, gke.gcr.io/watcher-daemonset, mcr.microsoft.com/oss/kubernetes/kube-proxy, public.ecr.aws/falcosecurity/falco, quay.io/calico/node, registry.k8s.io/dns/k8s-dns-node-cache, registry.k8s.io/ip-masq-agent-amd64, registry.k8s.io/kube-proxy, registry.k8s.io/prometheus-to-sd, sysdig/sysdig | excludes:requestObject.pod.containers.image.repository |
Indicators
These rows show field, operator, and value matches.