{"id":"a80d927d-ac6e-443f-a867-e8d6e3897318","title":"Creation Of Pod In System Namespace","description":"Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.\nSystem pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.\nAttackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.\nDeployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.\n","author":"Leo Tsaousis (@laripping)","status":"test","level":"medium","date":"2024-03-26","modified":"","tags":["attack.stealth","attack.t1036.005"],"technique_ids":["T1036.005"],"logsource":{"category":"application","product":"kubernetes","service":"audit"},"falsepositives":["System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace"],"references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/"],"source_path":"rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml","source_sha256":"ffca915cb3017f82c8595e0d361e296a4a0c5fba69f53b0341c0cc77c962d8a6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Creation Of Pod In System Namespace\nid: a80d927d-ac6e-443f-a867-e8d6e3897318\nstatus: test\ndescription: |\n    Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.\n    System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.\n    Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.\n    Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.\nreferences:\n    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: application\n    product: kubernetes\n    service: audit\ndetection:\n    selection:\n        verb: 'create'\n        objectRef.resource: 'pods'\n        objectRef.namespace: kube-system\n    condition: selection\nfalsepositives:\n    - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"}],"data_path":"data/detection-rules/a80d927d-ac6e-443f-a867-e8d6e3897318.json","kind":"sigma"}