cscli scenarios install crowdsecurity/k8s-audit-pod-host-networkDetects pods created with host networking in a K8S cluster, using the cluster audit logs.
The scenario needs logs from the pods resources at the Request level at a minimum.
No decision will be taken based on this scenario, it is only intended for notification purposes.
1type: trigger2name: crowdsecurity/k8s-audit-pod-host-network3description: "Detect pods started with host networking"4filter: |5 evt.Meta.log_type == 'k8s-audit' &&6 (7 (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.Verb == 'create' && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.RequestObject?.spec?.hostNetwork == true)8 ||9 (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.verb == 'create' && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.requestObject?.spec?.hostNetwork == true)10 )11labels:12 notification: true13 classification:14 - attack.T161015 behavior: "k8s:audit"16 label: "Kubernetes Pod Start With Host Networking"17 spoofable: 018 confidence: 319 service: k8s20