Kubernetes Pod created with a Sensitive hostPath Volume

edit

Kubernetes Pod created with a Sensitive hostPath Volume

edit

This rule detects when a pod is created with a sensitive volume of type hostPath. A hostPath volume type mounts a sensitive file or folder from the node to the container. If the container gets compromised, the attacker can use this mount for gaining access to the node. There are many ways a container with unrestricted access to the host filesystem can escalate privileges, including reading data from other containers, and accessing tokens of more privileged pods.

Rule type: query

Rule indices:

  • logs-kubernetes.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Kubernetes
  • Continuous Monitoring
  • Execution
  • Privilege Escalation

Version: 200 (version history)

Added (Elastic Stack release): 8.4.0

Last modified (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

An administrator may need to attach a hostPath volume for a legitimate reason. This alert should be investigated for legitimacy by determining if the kuberenetes.audit.requestObject.spec.volumes.hostPath.path triggered is one needed by its target container/pod. For example, when the fleet managed elastic agent is deployed as a daemonset it creates several hostPath volume mounts, some of which are sensitive host directories like /proc, /etc/kubernetes, and /var/log. Add exceptions for trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"

Investigation guide

edit

Rule query

edit
event.dataset : "kubernetes.audit_logs" and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
and kubernetes.audit.objectRef.resource:"pods" and
kubernetes.audit.verb:("create" or "update" or "patch") and
kubernetes.audit.requestObject.spec.volumes.hostPath.path: ("/" or
"/proc" or "/root" or "/var" or "/var/run" or
"/var/run/docker.sock" or "/var/run/crio/crio.sock" or
"/var/run/cri-dockerd.sock" or "/var/lib/kubelet" or
"/var/lib/kubelet/pki" or "/var/lib/docker/overlay2" or "/etc"
or "/etc/kubernetes" or "/etc/kubernetes/manifests" or
"/etc/kubernetes/pki" or "/home/admin") and not
kubernetes.audit.requestObject.spec.containers.image:
("docker.elastic.co/beats/elastic-agent:8.4.0")

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 200 (8.6.0 release)
  • Updated query, changed from:

    kubernetes.audit.objectRef.resource:"pods" and
    kubernetes.audit.verb:("create" or "update" or "patch") and
    kubernetes.audit.requestObject.spec.volumes.hostPath.path:("/" or
    "/proc" or "/root" or "/var" or "/var/run/docker.sock" or
    "/var/run/crio/crio.sock" or "/var/run/cri-dockerd.sock" or
    "/var/lib/kubelet" or "/var/lib/kubelet/pki" or
    "/var/lib/docker/overlay2" or "/etc" or "/etc/kubernetes" or
    "/etc/kubernetes/manifests" or "/home/admin")
Version 100 (8.5.0 release)
  • Updated query, changed from:

    kubernetes.audit.objectRef.resource:"pods" and
    kubernetes.audit.verb:("create" or "update" or "patch") and
    kubernetes.audit.requestObject.spec.volumes.hostPath.path:("/" or
    "/proc" or "/root" or "/var" or "/var/run/docker.sock" or
    "/var/run/crio/crio.sock" or "/var/run/cri-dockerd.sock" or
    "/var/lib/kubelet" or "/var/lib/kubelet/pki" or
    "/var/lib/docker/overlay2" or "/etc" or "/etc/kubernetes" or
    "/etc/kubernetes/manifests" or "/home/admin")