Skip to main content Inicio Creadores agentflocks flocks detecting-privilege-escalation-in-kubernetes-pods
detecting-privilege-escalation-in-kubernetes-pods Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
Ir a la instalación Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/AgentFlocks/flocks --skill detecting-privilege-escalation-in-kubernetes-podsEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
Explorador de archivos
9 archivos name detecting-privilege-escalation-in-kubernetes-pods description Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies. domain cybersecurity subdomain container-security tags ["kubernetes","privilege-escalation","security-context","capabilities","detection","pod-security"] version 1.0 author mahipal license Apache-2.0 d3fend_techniques ["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"] nist_csf ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
Detecting Privilege Escalation in Kubernetes Pods
Overview
Privilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).
When to Use
When investigating security incidents that require detecting privilege escalation in kubernetes pods
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Kubernetes cluster v1.25+ (Pod Security Admission support)
kubectl with cluster-admin access
Falco or similar runtime security tool
OPA Gatekeeper or Kyverno for admission policies
Privilege Escalation Vectors in Kubernetes
Vector Risk Detection Method privileged: true Full host access Admission control + audit hostPID: true Access host processes Admission control hostNetwork: true Access host network stack Admission control hostPath volumes Read/write host filesystem Admission control SYS_ADMIN capability Near-privileged access Admission + runtime allowPrivilegeEscalation: true setuid/setgid exploitation Admission control runAsUser: 0 Container root Admission control automountServiceAccountToken Token theft for API access Admission control Writable /proc or /sys Kernel parameter manipulation Runtime monitoring
Detection with Admission Control
Pod Security Admission (Built-in)
apiVersion: v1
kind: Namespace
metadata:
name:
production
labels:
pod-security.kubernetes.io/enforce:
restricted
pod-security.kubernetes.io/enforce-version:
latest
pod-security.kubernetes.io/audit:
restricted
pod-security.kubernetes.io/warn:
restricted
OPA Gatekeeper Policies
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sdangerouspriv
spec:
crd:
spec:
names:
kind: K8sDangerousPriv
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sdangerouspriv
dangerous_caps := {"SYS_ADMIN" , "SYS_PTRACE" , "SYS_MODULE" , "DAC_OVERRIDE" , "NET_ADMIN" , "NET_RAW" }
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
cap := container.securityContext.capabilities.add [_ ]
dangerous_caps [cap ]
msg := sprintf("Container %v adds dangerous capability: %v" , [container.name , cap ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
container.securityContext.privileged == true
msg := sprintf("Container %v runs in privileged mode" , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
container.securityContext.allowPrivilegeEscalation == true
msg := sprintf("Container %v allows privilege escalation" , [container.name ])
}
violation[{"msg": msg}] {
input.review.object.spec.hostPID == true
msg := "Pod uses host PID namespace"
}
violation[{"msg": msg}] {
input.review.object.spec.hostNetwork == true
msg := "Pod uses host network"
}
Runtime Detection with Falco
- rule: Setuid Binary Execution in Container
desc: Detect execution of setuid/setgid binaries in a container
condition: >
spawned_process and container and
(proc.name in (su, sudo, newgrp, chsh, passwd) or
proc.is_exe_upper_layer=true)
output: >
Setuid/setgid binary executed in container
(user=%user.name container=%container.name image=%container.image.repository
command=%proc.cmdline parent=%proc.pname)
priority: WARNING
tags: [container , privilege-escalation , T1548 ]
- rule: Capability Gained in Container
desc: Detect when a process gains elevated capabilities
condition: >
evt.type = capset and container and
evt.arg.cap != ""
output: >
Process gained capabilities in container
(container=%container.name image=%container.image.repository
capabilities=%evt.arg.cap command=%proc.cmdline)
priority: WARNING
tags: [container , privilege-escalation , T1548.001 ]
- rule: Container with Dangerous Capabilities Started
desc: Detect container launched with dangerous capabilities
condition: >
container_started and container and
(container.image.repository != "registry.k8s.io/pause") and
(container.cap_effective contains SYS_ADMIN or
container.cap_effective contains SYS_PTRACE or
container.cap_effective contains SYS_MODULE)
output: >
Container with dangerous capabilities
(container=%container.name image=%container.image.repository
caps=%container.cap_effective)
priority: CRITICAL
tags: [container , privilege-escalation , T1068 ]
- rule: Write to /etc/passwd in Container
desc: Detect writes to /etc/passwd inside container
condition: >
open_write and container and fd.name = /etc/passwd
output: >
Write to /etc/passwd in container
(container=%container.name image=%container.image.repository
command=%proc.cmdline user=%user.name)
priority: CRITICAL
tags: [container , privilege-escalation , T1136 ]
Kubernetes Audit Log Detection
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
resources:
- group: ""
resources: ["pods" ]
verbs: ["create" , "update" , "patch" ]
- level: RequestResponse
resources:
- group: "rbac.authorization.k8s.io"
resources: ["clusterroles" , "clusterrolebindings" , "roles" , "rolebindings" ]
verbs: ["create" , "update" , "patch" , "bind" , "escalate" ]
- level: Metadata
resources:
- group: ""
resources: ["serviceaccounts/token" ]
verbs: ["create" ]
Query Audit Logs for Privilege Escalation
kubectl logs -n kube-system kube-apiserver-* | \
jq 'select(.verb == "create" and .objectRef.resource == "pods") |
select(.requestObject.spec.containers[].securityContext.privileged == true)'
kubectl logs -n kube-system kube-apiserver-* | \
jq 'select(.objectRef.resource == "clusterrolebindings" and .verb == "create")'
Investigation Playbook
kubectl get pod <pod-name> -n <ns> -o jsonpath='{.spec.containers[*].securityContext}'
kubectl exec <pod-name> -n <ns> -- cat /proc/1/status | grep -i cap
kubectl get pods --all-namespaces -o json | \
jq '.items[] | select(.spec.containers[].securityContext.runAsUser == 0 or .spec.containers[].securityContext.privileged == true) | {name: .metadata.name, ns: .metadata.namespace}'
kubectl get pods --all-namespaces -o json | \
jq '.items[] | select(.spec.volumes[]?.hostPath != null) | {name: .metadata.name, ns: .metadata.namespace, paths: [.spec.volumes[].hostPath.path]}'
Best Practices
Enable Pod Security Admission at restricted level for production namespacesDrop ALL capabilities and add back only what is neededSet allowPrivilegeEscalation: false on all containersRun as non-root (runAsNonRoot: true, runAsUser > 0)Disable automountServiceAccountToken unless API access is neededMonitor with Falco for runtime privilege escalation attemptsAudit RBAC changes with Kubernetes audit loggingUse seccomp profiles to restrict syscalls 