Create Sensitive Mount Pod

Severity: WARNING
Source: k8saudit

Detect an attempt to start a pod with a volume from a sensitive host directory (i.e. /proc). Exceptions are made for known trusted images.

Telemetry coverage

Platform	Record / event type
Kubernetes	create-pods: create pods

Rules detecting the same action

These rules filter on the same operation.

Attach/Exec Pod (Falco)
Azure AKS Attempted User Exec into Pod (Elastic)
Container With A hostPath Mount Created (Sigma)
Create Disallowed Pod (Falco)
Create HostIPC Pod (Falco)
Create HostNetwork Pod (Falco)
Create HostPid Pod (Falco)
Create Privileged Pod (Falco)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    requestObject.pod.containers.image.repository in ["amazon/amazon-ecs-agent", "amazon/cloudwatch-agent", "docker.io/calico/node", "docker.io/cloudnativelabs/kube-router", "docker.io/consul", "docker.io/datadog/agent", "docker.io/datadog/docker-dd-agent", "docker.io/docker/ucp-agent", "docker.io/falcosecurity/falco", "docker.io/gliderlabs/logspout", "docker.io/google/cadvisor", "docker.io/netdata/netdata", "docker.io/prom/node-exporter", "docker.io/rook/toolbox", "docker.io/sysdig/sysdig", "falcosecurity/falco", "gcr.io/google_containers/hyperkube", "gcr.io/google_containers/kube-proxy", "gke.gcr.io/csi-node-driver-registrar", "gke.gcr.io/gcp-compute-persistent-disk-csi-driver", "prom/node-exporter", "public.ecr.aws/falcosecurity/falco", "sysdig/sysdig"]
  objectRef.resource eq "pods"
  objectRef.subresource is_null
  requestObject.pod.volumes.hostpath in ["/", "/etc", "/etc/kubernetes", "/etc/kubernetes/manifests", "/home/admin", "/proc", "/root", "/run/containerd/containerd.sock", "/var/lib/kubelet", "/var/lib/kubelet/pki", "/var/run/crio/crio.sock", "/var/run/docker.sock"]
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`requestObject.pod.containers.image.repository`	in	`amazon/amazon-ecs-agent`, `amazon/cloudwatch-agent`, `docker.io/calico/node`, `docker.io/cloudnativelabs/kube-router`, `docker.io/consul`, `docker.io/datadog/agent`, `docker.io/datadog/docker-dd-agent`, `docker.io/docker/ucp-agent`, `docker.io/falcosecurity/falco`, `docker.io/gliderlabs/logspout`, `docker.io/google/cadvisor`, `docker.io/netdata/netdata`, `docker.io/prom/node-exporter`, `docker.io/rook/toolbox`, `docker.io/sysdig/sysdig`, `falcosecurity/falco`, `gcr.io/google_containers/hyperkube`, `gcr.io/google_containers/kube-proxy`, `gke.gcr.io/csi-node-driver-registrar`, `gke.gcr.io/gcp-compute-persistent-disk-csi-driver`, `prom/node-exporter`, `public.ecr.aws/falcosecurity/falco`, `sysdig/sysdig`	`excludes:requestObject.pod.containers.image.repository`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`objectRef.resource`	eq	`pods`	`field:"objectRef.resource" kind:eq value:"pods"`
`objectRef.subresource`	is_null	(no value, null check)	`field:"objectRef.subresource" kind:is_null`
`requestObject.pod.volumes.hostpath`	in	`/` `/etc` `/etc/kubernetes` `/etc/kubernetes/manifests` `/home/admin` `/proc` `/root` `/run/containerd/containerd.sock` `/var/lib/kubelet` `/var/lib/kubelet/pki` `/var/run/crio/crio.sock` `/var/run/docker.sock`	`field:"requestObject.pod.volumes.hostpath" kind:in`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`