detecting-privilege-escalation-in-kubernetes-pods

name	detecting-privilege-escalation-in-kubernetes-pods
description	Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
domain	cybersecurity
subdomain	container-security
tags	["kubernetes","privilege-escalation","security-context","capabilities","detection","pod-security"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"]
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Detecting Privilege Escalation in Kubernetes Pods

Overview

Privilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).

When to Use

• When investigating security incidents that require detecting privilege escalation in kubernetes pods
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Kubernetes cluster v1.25+ (Pod Security Admission support)
• kubectl with cluster-admin access
• Falco or similar runtime security tool
• OPA Gatekeeper or Kyverno for admission policies

Privilege Escalation Vectors in Kubernetes

Vector	Risk	Detection Method
privileged: true	Full host access	Admission control + audit
hostPID: true	Access host processes	Admission control
hostNetwork: true	Access host network stack	Admission control
hostPath volumes	Read/write host filesystem	Admission control
SYS_ADMIN capability	Near-privileged access	Admission + runtime
allowPrivilegeEscalation: true	setuid/setgid exploitation	Admission control
runAsUser: 0	Container root	Admission control
automountServiceAccountToken	Token theft for API access	Admission control
Writable /proc or /sys	Kernel parameter manipulation	Runtime monitoring

Detection with Admission Control

Pod Security Admission (Built-in)

# Enforce restricted policy on namespace
apiVersion: v1
kind: