Loading

GKE Pod Created with a Sensitive hostPath Volume

Detects GKE pod create, update, or patch events that mount sensitive hostPath volumes such as the root filesystem, kubelet paths, or container runtime sockets. This can enable container escape and credential theft. System identities and controller-owned workloads are excluded.

Rule type: query
Rule indices:

  • logs-gcp.audit-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: Kubernetes
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Use Case: Threat Detection
  • Tactic: Privilege Escalation
  • Tactic: Execution
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

Review gcp.audit.request.spec.volumes.hostPath.path and whether the mount is required for the workload.

  • Confirm the hostPath and container images in the audit request.
  • Review user.email, namespace, and follow-on secret or exec activity.
  • Platform DaemonSets mounting /proc or kubelet paths; validate against known agents.

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

data_stream.dataset:gcp.audit and event.outcome:success and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.volumes.hostPath.path:(
  "/" or "/proc" or "/root" or "/var" or "/var/run" or "/var/run/docker.sock" or "/var/run/crio/crio.sock" or
  "/var/run/cri-dockerd.sock" or "/var/lib/kubelet" or "/var/lib/kubelet/pki" or "/var/lib/docker/overlay2" or "/etc" or
  "/etc/kubernetes" or "/etc/kubernetes/manifests" or "/etc/kubernetes/pki" or "/home/admin"
) and not user.email:system\:* and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK