{"id":"402b955c-8fe0-4a8c-b635-622b4ac5f902","title":"Container With A hostPath Mount Created","description":"Detects creation of a container with a hostPath mount.\nA hostPath volume mounts a directory or a file from the node to the container.\nAttackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.\n","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":"","tags":["attack.t1611","attack.privilege-escalation"],"technique_ids":["T1611"],"logsource":{"category":"application","product":"kubernetes","service":"audit"},"falsepositives":["The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace."],"references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/","https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"],"source_path":"rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml","source_sha256":"fac1fbdc56e79059f51d2e8c35f40880c991b43611bc54a2df45408d40841229","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Container With A hostPath Mount Created\nid: 402b955c-8fe0-4a8c-b635-622b4ac5f902\nstatus: test\ndescription: |\n    Detects creation of a container with a hostPath mount.\n    A hostPath volume mounts a directory or a file from the node to the container.\n    Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.\nreferences:\n    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/\n    - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n    - attack.t1611\n    - attack.privilege-escalation\nlogsource:\n    category: application\n    product: kubernetes\n    service: audit\ndetection:\n    selection:\n        verb: 'create'\n        objectRef.resource: 'pods'\n        hostPath: '*' # Note: Add the \"exists\" when it's implemented in SigmaHQ/Aurora\n    condition: selection\nfalsepositives:\n    - The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1611","id":"T1611","name":"Escape to Host","page":"techniques/enterprise/T1611/"}],"data_path":"data/detection-rules/402b955c-8fe0-4a8c-b635-622b4ac5f902.json","kind":"sigma"}