Kubernetes Privileged Or Host Sensitive Workload Creation

Query

let Lookback = 1d;
let AllowedAdminUsers = dynamic([
	"system:serviceaccount:flux-system:kustomize-controller",
	"system:serviceaccount:argocd:argocd-application-controller"
]);
// Privileged workload or host access created/updated
CloudAuditEvents
| where Timestamp > ago(Lookback)
| where DataSource =~ "Kubernetes Audit"
| extend Verb = tolower(coalesce(tostring(RawEventData.verb), OperationName))
| extend Resource = tolower(tostring(RawEventData.objectRef.resource))
| where Verb in ("create", "update", "patch")
| where Resource in ("pods", "deployments", "daemonsets", "statefulsets", "replicasets", "jobs", "cronjobs")
| extend Namespace = tostring(RawEventData.objectRef.namespace), Workload = tostring(RawEventData.objectRef.name)
| extend User = tostring(RawEventData.user.username), SourceIp = tostring(RawEventData.sourceIPs[0])
| extend RequestObject = tostring(RawEventData.requestObject)
| where RequestObject has_any ("\"privileged\":true", "\"hostNetwork\":true", "\"hostPID\":true", "\"hostIPC\":true", "\"hostPath\"", "/var/run/docker.sock", "/run/containerd/containerd.sock", "/var/lib/kubelet", "\"SYS_ADMIN\"", "\"NET_ADMIN\"", "\"SYS_PTRACE\"")
| where User !in (AllowedAdminUsers)
| project Timestamp, Detection="K8S privileged or host-access workload", User, SourceIp, Namespace, Resource, Workload, UserAgent, RequestObject, RawEventData

About this query

Kubernetes Privileged or Host-Sensitive Workload Creation

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1610	Deploy Container	https://attack.mitre.org/techniques/T1610
T1611	Escape to Host	https://attack.mitre.org/techniques/T1611

Description

This rule detects the creation, update, or patching of Kubernetes workloads that request privileged capabilities or sensitive host access, such as host networking, PID/IPC namespaces, access to container runtimes, or sensitive security contexts. These configurations can be abused by adversaries to achieve container escape or host compromise.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect potentially risky activities in a Kubernetes environment by monitoring for the creation, update, or modification of workloads that request elevated privileges or sensitive access to the host system. Here's a simplified breakdown of what the query does:

Time Frame: It looks at events from the past day (Lookback = 1d).
Allowed Users: It defines a list of users (AllowedAdminUsers) who are permitted to perform these actions without raising an alert. These are typically service accounts used by trusted applications.
Data Source: It filters events from the "Kubernetes Audit" data source, which logs actions taken within the Kubernetes cluster.
Action Types: It focuses on actions where workloads are created, updated, or patched (Verb in ("create", "update", "patch")).
Resource Types: It examines specific Kubernetes resources like pods, deployments, daemonsets, statefulsets, replicasets, jobs, and cronjobs.
Sensitive Configurations: It checks if the workload requests privileged capabilities or host access, such as:
- Privileged mode
- Host networking
- Host PID/IPC namespaces
- Access to container runtimes or sensitive directories
- Specific Linux capabilities like SYS_ADMIN, NET_ADMIN, or SYS_PTRACE
Exclusion of Allowed Users: It excludes actions performed by the allowed admin users to reduce false positives.
Output: If a suspicious action is detected, it logs details such as the timestamp, user, source IP, namespace, resource, workload name, and the raw event data for further investigation.

The goal of this query is to identify and alert on configurations that could be exploited by attackers to escape from a container to the host system or to compromise the host.