Kubernetes Privileged Pod Creation Detection Scenario by crowdsecurity | CrowdSec Hub

Kubernetes Privileged Pod Creation

Attack scenariok8s:auditMITRE T1610

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/k8s-audit-privileged-pod-creation

Detect privileged pod creation

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/k8s-audit

Installs 1 parser and 7 scenarios.

View Kubernetes - Audit Detection →

Installation

sudo cscli scenarios install crowdsecurity/k8s-audit-privileged-pod-creation

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/k8s-audit-privileged-pod-creation.yaml· 33 linesGitHub

1type: trigger1
2name: crowdsecurity/k8s-audit-privileged-pod-creation
3description: "Detect privileged pod creation"
4filter: |2
5  evt.Meta.log_type == 'k8s-audit' &&
6  (
7   (
8    evt.Meta.datasource_type == "k8s-audit" &&
9    evt.Unmarshaled.k8s_audit.Verb == 'create' &&
10    evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' &&
11    evt.Unmarshaled.k8s_audit.RequestObject != nil &&
12    evt.Unmarshaled.k8s_audit.RequestObject.spec != nil &&
13    any(evt.Unmarshaled.k8s_audit.RequestObject.spec.containers, { .securityContext != nil && .securityContext.privileged == true })
14   )
15   ||
16   (
17    evt.Meta.datasource_type != "k8s-audit" &&
18    evt.Unmarshaled.k8s_audit.verb == 'create' &&
19    evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' &&
20    evt.Unmarshaled.k8s_audit.requestObject != nil &&
21    evt.Unmarshaled.k8s_audit.requestObject.spec != nil &&
22    any(evt.Unmarshaled.k8s_audit.requestObject.spec.containers, { .securityContext != nil && .securityContext.privileged == true })
23   )
24  )
25labels:
26  notification: true
27  classification:3
28    - attack.T1610
29  behavior: "k8s:audit"
30  label: "Kubernetes Privileged Pod Creation"
31  spoofable: 0
32  confidence: 3
33  service: k8s

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects privileged pods creation in a K8S cluster, using the cluster audit logs.

The scenario needs logs from the pods resources at the Request level at a minimum.

No decision will be taken based on this scenario, it is only intended for notification purposes.