Loading

GKE Pod Created With HostPID

Detects GKE pod create, update, or patch events that enable host PID namespace sharing. HostPID exposes host processes and can support privilege escalation, especially with ptrace or privileged containers. System identities and controller-owned workloads are excluded.

Rule type: query
Rule indices:

  • logs-gcp.audit-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: Kubernetes
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Use Case: Threat Detection
  • Tactic: Privilege Escalation
  • Tactic: Execution
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

HostPID visibility into host processes is high risk. Confirm whether the pod spec change was authorized.

  • Review actor (user.email), target pod, and images in the audit request.
  • Correlate with exec, secret access, or RBAC changes from the same identity.
  • Break-glass troubleshooting; tune by user or namespace.

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

data_stream.dataset:gcp.audit and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.hostPID:true and not user.email:system\:* and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK