GKE Pod Created With HostIPC
Detects GKE pod create, update, or patch events that enable host IPC namespace sharing. This exposes host inter-process communication mechanisms and can support privilege escalation. Controller-owned workloads are excluded.
Rule type: query
Rule indices:
- logs-gcp.audit-*
Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:
- https://kubernetes.io/docs/concepts/security/pod-security-standards/
- https://bishopfox.com/blog/kubernetes-pod-privilege-escalation
Tags:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Privilege Escalation
- Tactic: Execution
- Resources: Investigation Guide
Version: 1
Rule authors:
- Elastic
Rule license: Elastic License v2
Host IPC lets a pod interact with host IPC facilities. Review the pod spec, actor, and whether the change was expected.
- Confirm
gcp.audit.request.spec.hostIPCand targeted namespace or pod. - Review
user.emailand correlate with other risky pod modifications.
- Break-glass debugging on nodes; allowlist known admin identities.
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.
data_stream.dataset:gcp.audit and event.outcome:success and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.hostIPC:true and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")
Framework: MITRE ATT&CK
Tactic:
- Name: Privilege Escalation
- Id: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
Technique:
- Name: Escape to Host
- Id: T1611
- Reference URL: https://attack.mitre.org/techniques/T1611/
Framework: MITRE ATT&CK
Tactic:
- Name: Execution
- Id: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Deploy Container
- Id: T1610
- Reference URL: https://attack.mitre.org/techniques/T1610/