GCP K8S Privileged Pod Created

Description

Alerts when a user creates privileged pod. These particular pods have full access to the host’s namespace and devices, have the ability to exploit the kernel, have dangerous linux capabilities, and can be a powerful launching point for further attacks. In the event of a successful container escape where a user is operating with root privileges, the attacker retains this role on the node.

Query · python

from panther_base_helpers import deep_get
from panther_gcp_helpers import gcp_alert_context, is_gke_system_namespace, is_gke_system_principal


def rule(event):
    # Check basic conditions that would exclude this event
    if (
        event.deep_get("protoPayload", "response", "status") == "Failure"
        or event.deep_get("protoPayload", "methodName") != "io.k8s.core.v1.pods.create"
    ):
        return False

    # Check if this is a known service account or system namespace that should be excluded
    principal_email = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default=""
    )
    resource_name = event.deep_get("protoPayload", "resourceName", default="")

    if is_gke_system_principal(principal_email) or is_gke_system_namespace(resource_name):
        return False

    # Check for privileged pod creation
    authorization_info = event.deep_walk("protoPayload", "authorizationInfo")
    if not authorization_info:
        return False

    containers_info = event.deep_walk("protoPayload", "response", "spec", "containers")
    for auth in authorization_info:
        if auth.get("permission") == "io.k8s.core.v1.pods.create" and auth.get("granted") is True:
            for security_context in containers_info:
                # Check for privileged pods and pods running as root
                # Reference:
                # https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
                if (
                    deep_get(security_context, "securityContext", "privileged") is True
                    or deep_get(security_context, "securityContext", "runAsNonRoot") is False
                ):
                    return True

    return False


def title(event):
    actor = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )
    pod_name = event.deep_get("protoPayload", "resourceName", default="<RESOURCE_NOT_FOUND>")
    project_id = event.deep_get("resource", "labels", "project_id", default="<PROJECT_NOT_FOUND>")

    return f"[GCP]: [{actor}] created a privileged pod [{pod_name}] in project [{project_id}]"


def dedup(event):
    return event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )


def alert_context(event):
    context = gcp_alert_context(event)
    containers_info = event.deep_walk("protoPayload", "response", "spec", "containers", default=[])
    context["pod_security_context"] = [i.get("securityContext") for i in containers_info]
    return context

Analyst notes

Investigate the reason of creating privileged pod. Advise that it is discouraged practice. Create ticket if appropriate.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Experimental
Query type: python
Created: 2024-02-13
Modified: 2026-04-07
Authored by: panther-labs
Source ID
Upstream: rules/gcp_k8s_rules/gcp_k8s_privileged_pod_created.yml
Type: rule
Version: 3
References: https://www.golinuxcloud.com/kubernetes-privileged-pod-examples/
Data sources: GCP.AuditLog

ATT&CK

TA0004 T1548