Kubernetes Pod Start With Host Networking
Attack scenariok8s:auditMITRE T1610
- Version
- 0.4
- Name
- crowdsecurity/k8s-audit-pod-host-network
Detect pods started with host networking
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/k8s-auditInstalls 1 parser and 7 scenarios.
View Kubernetes - Audit Detection →Installation
sudo cscli scenarios install crowdsecurity/k8s-audit-pod-host-networkThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: triggername: crowdsecurity/k8s-audit-pod-host-networkdescription: "Detect pods started with host networking"filter: |evt.Meta.log_type == 'k8s-audit' &&((evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.Verb == 'create' && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.RequestObject?.spec?.hostNetwork == true)||(evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.verb == 'create' && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.requestObject?.spec?.hostNetwork == true))labels:notification: trueclassification:- attack.T1610behavior: "k8s:audit"label: "Kubernetes Pod Start With Host Networking"spoofable: 0confidence: 3service: k8s
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Detects pods created with host networking in a K8S cluster, using the cluster audit logs.
The scenario needs logs from the pods resources at the Request level at a minimum.
No decision will be taken based on this scenario, it is only intended for notification purposes.