Privileged Container Deployed

Status: test
Severity: low
Log source: category application, product kubernetes, service audit
Author: Leo Tsaousis (@laripping)
Source: github.com/SigmaHQ/sigma

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1611` Escape to Host

Telemetry coverage

Platform	Record / event type
Kubernetes	create-pods: create pods

Rules detecting the same action

These rules filter on the same operation.

Attach/Exec Pod (Falco)
Azure AKS Attempted User Exec into Pod (Elastic)
Container With A hostPath Mount Created (Sigma)
Create Disallowed Pod (Falco)
Create HostIPC Pod (Falco)
Create HostNetwork Pod (Falco)
Create HostPid Pod (Falco)
Create Privileged Pod (Falco)

Rule body

title: Privileged Container Deployed
id: c5cd1b20-36bb-488d-8c05-486be3d0cb97
status: test
description: |
    Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks.
    A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
    Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields
references:
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
    - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer
    - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html
    - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
    - attack.t1611
    - attack.privilege-escalation
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'create'
        objectRef.resource: 'pods'
        capabilities: '*' # Note: Add the "exists" when it's implemented in SigmaHQ/Aurora
    condition: selection
falsepositives:
    - Unknown
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    verb: 'create'
    objectRef.resource: 'pods'
    capabilities: '*'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`capabilities`	wildcard	`*`	`field:"capabilities" kind:wildcard value:"*"`
`objectRef.resource`	eq	`pods`	`field:"objectRef.resource" kind:eq value:"pods"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`