Container With A hostPath Mount Created

Status: test
Severity: low
Log source: category application, product kubernetes, service audit
Author: Leo Tsaousis (@laripping)
Source: github.com/SigmaHQ/sigma

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Known false positives

The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1611` Escape to Host

Telemetry coverage

Platform	Record / event type
Kubernetes	create-pods: create pods

Rules detecting the same action

These rules filter on the same operation.

Azure AKS Attempted User Exec into Pod (Elastic)
Creation Of Pod In System Namespace (Sigma)
Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
Exec into Pod (Panther)
GCP Break-glass Container Workload Deployed (Sigma)
GCP K8s Pod Attached To Node Host Network (Panther)
GCP K8S Pod Create Or Modify Host Path Volume Mount (Panther)
GCP K8s Pod Using Host PID Namespace (Panther)

Rule body

title: Container With A hostPath Mount Created
id: 402b955c-8fe0-4a8c-b635-622b4ac5f902
status: test
description: |
    Detects creation of a container with a hostPath mount.
    A hostPath volume mounts a directory or a file from the node to the container.
    Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.
references:
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
    - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
    - attack.t1611
    - attack.privilege-escalation
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'create'
        objectRef.resource: 'pods'
        hostPath: '*' # Note: Add the "exists" when it's implemented in SigmaHQ/Aurora
    condition: selection
falsepositives:
    - The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    verb: 'create'
    objectRef.resource: 'pods'
    hostPath: '*'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`hostPath`	wildcard	`*`	`field:"hostPath" kind:wildcard value:"*"`
`objectRef.resource`	eq	`pods`	`field:"objectRef.resource" kind:eq value:"pods"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`