Kubernetes Pod Start With Host Path Detection Scenario by crowdsecurity

Name: Kubernetes Pod Start With Host Path
Author: crowdsecurity

Detects pods creation mounting a sensitive host folder in a K8S cluster, using the cluster audit logs.

Folders or files considered sensitive are:

/
/etc
/etc/kubernetes
/etc/kubernetes/manifests
/proc
/root
/home/admin
/var/lib/kubelet
/var/lib/kubelet/pki
/var/run/docker.sock
/var/run/crio/crio.sock

The scenario needs logs from the pods resources at the Request level at a minimum.

No decision will be taken based on this scenario, it is only intended for notification purposes.

1type: trigger

2name: crowdsecurity/k8s-audit-pod-host-path-volume

3description: "Detect pods mounting a sensitive host folder"

4filter: |

5 evt.Meta.log_type == 'k8s-audit' &&

6 (

7 (

8 evt.Meta.datasource_type == "k8s-audit" &&

9 evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' &&

10 evt.Unmarshaled.k8s_audit.RequestObject != nil &&

11 evt.Unmarshaled.k8s_audit.RequestObject.spec != nil &&

12 evt.Unmarshaled.k8s_audit.RequestObject.spec.volumes != nil &&

13 any(evt.Unmarshaled.k8s_audit.RequestObject.spec.volumes, { .hostPath != nil && .hostPath.path in ["/proc", "/var/run/docker.sock", "/", "/etc", "/root", "/var/run/crio/crio.sock", "/home/admin", "/var/lib/kubelet", "/var/lib/kubelet/pki", "/etc/kubernetes", "/etc/kubernetes/manifests"] })

14 )

15 ||

16 (

17 evt.Meta.datasource_type != "k8s-audit" &&

18 evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' &&

19 evt.Unmarshaled.k8s_audit.requestObject != nil &&

20 evt.Unmarshaled.k8s_audit.requestObject.spec != nil &&

21 evt.Unmarshaled.k8s_audit.requestObject.spec.volumes != nil &&

22 any(evt.Unmarshaled.k8s_audit.requestObject.spec.volumes, { .hostPath != nil && .hostPath.path in ["/proc", "/var/run/docker.sock", "/", "/etc", "/root", "/var/run/crio/crio.sock", "/home/admin", "/var/lib/kubelet", "/var/lib/kubelet/pki", "/etc/kubernetes", "/etc/kubernetes/manifests"] })

23 )

24 )

25labels:

26 notification: true

27 classification:

28 - attack.T1610

29 behavior: "k8s:audit"

30 label: "Kubernetes Pod Start With Host Path"

31 spoofable: 0

32 confidence: 3

33 service: k8s

Hub configuration

« Kubernetes Pod Start With Host Path »
v0.5 by crowdsecurity / k8s-audit-pod-host-path-volume
Attack scenariok8sNot spoofableHigh confidence

Hub configuration

« Kubernetes Pod Start With Host Path »v0.5 by crowdsecurity / k8s-audit-pod-host-path-volumeAttack scenarioKubernetesk8sNot spoofableHigh confidenceMITRE:T1610

« Kubernetes Pod Start With Host Path »
v0.5 by crowdsecurity / k8s-audit-pod-host-path-volume
Attack scenariok8sNot spoofableHigh confidence