Detection rules › Sigma
Creation Of Pod In System Namespace
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036.005 Masquerading: Match Legitimate Resource Name or Location |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Kubernetes-pods | create-pods | create pods |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- Container With A hostPath Mount Created (Sigma)
- Kubernetes Anonymous User Create/Update/Patch Pods Request (Elastic)
- Kubernetes Container Created with Excessive Linux Capabilities (Elastic)
- Kubernetes Create or Update Privileged Pod (Splunk)
- Kubernetes Pod Created in Default Namespace (Splunk)
- Kubernetes Pod Created with a Sensitive hostPath Volume (Elastic)
- Kubernetes Pod Created With HostIPC (Elastic)
- Kubernetes Pod Created With HostNetwork (Elastic)
Rule body yaml
title: Creation Of Pod In System Namespace
id: a80d927d-ac6e-443f-a867-e8d6e3897318
status: test
description: |
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: 'create'
objectRef.resource: 'pods'
objectRef.namespace: kube-system
condition: selection
falsepositives:
- System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
verb: 'create'
objectRef.resource: 'pods'
objectRef.namespace: kube-system
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
objectRef.namespace | eq |
|
objectRef.resource | eq |
|
verb | eq |
|