Skip to main content الرئيسية المنشئون agentflocks flocks detecting-privilege-escalation-in-kubernetes-pods
detecting-privilege-escalation-in-kubernetes-pods Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
الانتقال إلى التثبيت سوق المهارات اكتشف واستكشف مهارات الذكاء الاصطناعي التي بناها المجتمع.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
عرض تفاصيل Prompt يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/AgentFlocks/flocks --skill detecting-privilege-escalation-in-kubernetes-podsيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
تحميل Zip جاري التحميل... المهن ذات الصلة SOC
استنادا إلى تصنيف SOC المهني
name detecting-privilege-escalation-in-kubernetes-pods description Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies. domain cybersecurity subdomain container-security tags ["kubernetes","privilege-escalation","security-context","capabilities","detection","pod-security"] version 1.0 author mahipal license Apache-2.0 d3fend_techniques ["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"] nist_csf ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
Detecting Privilege Escalation in Kubernetes Pods
Overview
Privilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).
When to Use
When investigating security incidents that require detecting privilege escalation in kubernetes pods
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Kubernetes cluster v1.25+ (Pod Security Admission support)
kubectl with cluster-admin access
Falco or similar runtime security tool
OPA Gatekeeper or Kyverno for admission policies
Privilege Escalation Vectors in Kubernetes
Vector Risk Detection Method privileged: true Full host access Admission control + audit hostPID: true Access host processes Admission control hostNetwork: true Access host network stack Admission control hostPath volumes Read/write host filesystem Admission control SYS_ADMIN capability Near-privileged access Admission + runtime allowPrivilegeEscalation: true setuid/setgid exploitation Admission control runAsUser: 0 Container root Admission control automountServiceAccountToken Token theft for API access Admission control Writable /proc or /sys Kernel parameter manipulation Runtime monitoring
Detection with Admission Control
Pod Security Admission (Built-in)
apiVersion: v1
kind: Namespace
metadata:
name:
production
labels:
pod-security.kubernetes.io/enforce:
restricted
pod-security.kubernetes.io/enforce-version:
latest
pod-security.kubernetes.io/audit:
restricted
pod-security.kubernetes.io/warn:
restricted
OPA Gatekeeper Policies
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sdangerouspriv
spec:
crd:
spec:
names:
kind: K8sDangerousPriv
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sdangerouspriv
dangerous_caps := {"SYS_ADMIN" , "SYS_PTRACE" , "SYS_MODULE" , "DAC_OVERRIDE" , "NET_ADMIN" , "NET_RAW" }
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
cap := container.securityContext.capabilities.add [_ ]
dangerous_caps [cap ]
msg := sprintf("Container %v adds dangerous capability: %v" , [container.name , cap ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
container.securityContext.privileged == true
msg := sprintf("Container %v runs in privileged mode" , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
container.securityContext.allowPrivilegeEscalation == true
msg := sprintf("Container %v allows privilege escalation" , [container.name ])
}
violation[{"msg": msg}] {
input.review.object.spec.hostPID == true
msg := "Pod uses host PID namespace"
}
violation[{"msg": msg}] {
input.review.object.spec.hostNetwork == true
msg := "Pod uses host network"
}
Runtime Detection with Falco
- rule: Setuid Binary Execution in Container
desc: Detect execution of setuid/setgid binaries in a container
condition: >
spawned_process and container and
(proc.name in (su, sudo, newgrp, chsh, passwd) or
proc.is_exe_upper_layer=true)
output: >
Setuid/setgid binary executed in container
(user=%user.name container=%container.name image=%container.image.repository
command=%proc.cmdline parent=%proc.pname)
priority: WARNING
tags: [container , privilege-escalation , T1548 ]
- rule: Capability Gained in Container
desc: Detect when a process gains elevated capabilities
condition: >
evt.type = capset and container and
evt.arg.cap != ""
output: >
Process gained capabilities in container
(container=%container.name image=%container.image.repository
capabilities=%evt.arg.cap command=%proc.cmdline)
priority: WARNING
tags: [container , privilege-escalation , T1548.001 ]
- rule: Container with Dangerous Capabilities Started
desc: Detect container launched with dangerous capabilities
condition: >
container_started and container and
(container.image.repository != "registry.k8s.io/pause") and
(container.cap_effective contains SYS_ADMIN or
container.cap_effective contains SYS_PTRACE or
container.cap_effective contains SYS_MODULE)
output: >
Container with dangerous capabilities
(container=%container.name image=%container.image.repository
caps=%container.cap_effective)
priority: CRITICAL
tags: [container , privilege-escalation , T1068 ]
- rule: Write to /etc/passwd in Container
desc: Detect writes to /etc/passwd inside container
condition: >
open_write and container and fd.name = /etc/passwd
output: >
Write to /etc/passwd in container
(container=%container.name image=%container.image.repository
command=%proc.cmdline user=%user.name)
priority: CRITICAL
tags: [container , privilege-escalation , T1136 ]
Kubernetes Audit Log Detection
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
resources:
- group: ""
resources: ["pods" ]
verbs: ["create" , "update" , "patch" ]
- level: RequestResponse
resources:
- group: "rbac.authorization.k8s.io"
resources: ["clusterroles" , "clusterrolebindings" , "roles" , "rolebindings" ]
verbs: ["create" , "update" , "patch" , "bind" , "escalate" ]
- level: Metadata
resources:
- group: ""
resources: ["serviceaccounts/token" ]
verbs: ["create" ]
Query Audit Logs for Privilege Escalation
kubectl logs -n kube-system kube-apiserver-* | \
jq 'select(.verb == "create" and .objectRef.resource == "pods") |
select(.requestObject.spec.containers[].securityContext.privileged == true)'
kubectl logs -n kube-system kube-apiserver-* | \
jq 'select(.objectRef.resource == "clusterrolebindings" and .verb == "create")'
Investigation Playbook
kubectl get pod <pod-name> -n <ns> -o jsonpath='{.spec.containers[*].securityContext}'
kubectl exec <pod-name> -n <ns> -- cat /proc/1/status | grep -i cap
kubectl get pods --all-namespaces -o json | \
jq '.items[] | select(.spec.containers[].securityContext.runAsUser == 0 or .spec.containers[].securityContext.privileged == true) | {name: .metadata.name, ns: .metadata.namespace}'
kubectl get pods --all-namespaces -o json | \
jq '.items[] | select(.spec.volumes[]?.hostPath != null) | {name: .metadata.name, ns: .metadata.namespace, paths: [.spec.volumes[].hostPath.path]}'
Best Practices
Enable Pod Security Admission at restricted level for production namespacesDrop ALL capabilities and add back only what is neededSet allowPrivilegeEscalation: false on all containersRun as non-root (runAsNonRoot: true, runAsUser > 0)Disable automountServiceAccountToken unless API access is neededMonitor with Falco for runtime privilege escalation attemptsAudit RBAC changes with Kubernetes audit loggingUse seccomp profiles to restrict syscalls 