Detection rules › Falco
Pod Created in Kube Namespace
Detect any attempt to create a pod in the kube-system or kube-public namespaces
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-pods: create pods |
Rules detecting the same action
These rules filter on the same operation.
- Attach/Exec Pod (Falco)
- Azure AKS Attempted User Exec into Pod (Elastic)
- Container With A hostPath Mount Created (Sigma)
- Create Disallowed Pod (Falco)
- Create HostIPC Pod (Falco)
- Create HostNetwork Pod (Falco)
- Create HostPid Pod (Falco)
- Create Privileged Pod (Falco)
Stages and Predicates
Stage 1: falco_condition
and
not
or
requestObject.pod.containers.image.repository in ["gcr.io/google-containers/prometheus-to-sd", "gcr.io/projectcalico-org/node", "gke.gcr.io/addon-resizer", "gke.gcr.io/gke-metadata-server", "gke.gcr.io/heapster", "gke.gcr.io/kube-proxy", "gke.gcr.io/netd-amd64", "gke.gcr.io/watcher-daemonset", "kope/kube-apiserver-healthcheck", "registry.k8s.io/addon-resizer", "registry.k8s.io/ip-masq-agent-amd64", "registry.k8s.io/k8s-dns-dnsmasq-nanny-amd64", "registry.k8s.io/k8s-dns-kube-dns-amd64", "registry.k8s.io/k8s-dns-sidecar-amd64", "registry.k8s.io/kube-apiserver", "registry.k8s.io/metrics-server-amd64", "registry.k8s.io/prometheus-to-sd"]
requestObject.pod.containers.image.repository in ["gke.gcr.io/addon-resizer", "gke.gcr.io/cluster-proportional-autoscaler", "gke.gcr.io/csi-node-driver-registrar", "gke.gcr.io/event-exporter", "gke.gcr.io/fluent-bit", "gke.gcr.io/fluent-bit-gke-exporter", "gke.gcr.io/gcp-compute-persistent-disk-csi-driver", "gke.gcr.io/gke-metrics-agent", "gke.gcr.io/ingress-gce-404-server-with-metrics", "gke.gcr.io/k8s-dns-dnsmasq-nanny", "gke.gcr.io/k8s-dns-kube-dns", "gke.gcr.io/k8s-dns-node-cache", "gke.gcr.io/k8s-dns-sidecar", "gke.gcr.io/kube-proxy-amd64", "gke.gcr.io/metrics-server", "gke.gcr.io/netd", "gke.gcr.io/prometheus-to-sd", "gke.gcr.io/proxy-agent"]
objectRef.namespace in ["kube-public", "kube-system"]
objectRef.resource eq "pods"
objectRef.subresource is_null
stage eq "ResponseComplete"
verb eq "create"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
requestObject.pod.containers.image.repository | in | gcr.io/google-containers/prometheus-to-sd, gcr.io/projectcalico-org/node, gke.gcr.io/addon-resizer, gke.gcr.io/gke-metadata-server, gke.gcr.io/heapster, gke.gcr.io/kube-proxy, gke.gcr.io/netd-amd64, gke.gcr.io/watcher-daemonset, kope/kube-apiserver-healthcheck, registry.k8s.io/addon-resizer, registry.k8s.io/ip-masq-agent-amd64, registry.k8s.io/k8s-dns-dnsmasq-nanny-amd64, registry.k8s.io/k8s-dns-kube-dns-amd64, registry.k8s.io/k8s-dns-sidecar-amd64, registry.k8s.io/kube-apiserver, registry.k8s.io/metrics-server-amd64, registry.k8s.io/prometheus-to-sd | excludes:requestObject.pod.containers.image.repository |
requestObject.pod.containers.image.repository | in | gke.gcr.io/addon-resizer, gke.gcr.io/cluster-proportional-autoscaler, gke.gcr.io/csi-node-driver-registrar, gke.gcr.io/event-exporter, gke.gcr.io/fluent-bit, gke.gcr.io/fluent-bit-gke-exporter, gke.gcr.io/gcp-compute-persistent-disk-csi-driver, gke.gcr.io/gke-metrics-agent, gke.gcr.io/ingress-gce-404-server-with-metrics, gke.gcr.io/k8s-dns-dnsmasq-nanny, gke.gcr.io/k8s-dns-kube-dns, gke.gcr.io/k8s-dns-node-cache, gke.gcr.io/k8s-dns-sidecar, gke.gcr.io/kube-proxy-amd64, gke.gcr.io/metrics-server, gke.gcr.io/netd, gke.gcr.io/prometheus-to-sd, gke.gcr.io/proxy-agent | excludes:requestObject.pod.containers.image.repository |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
objectRef.namespace | in |
| field:"objectRef.namespace" kind:in |
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"pods" |
objectRef.subresource | is_null | field:"objectRef.subresource" kind:is_null | |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
verb | eq |
| field:"verb" kind:eq value:"create" |