Sunturai
Back to results
LowSigmaHQLeo Tsaousis (@laripping)

Container With A hostPath Mount Created

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one…

Description

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Detection logic

Detection requirements

Platform
ContainersESXiLinuxWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
kubernetes
Log source category
application
Log source service
audit

Known benign triggers

  • The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice