GCP K8s Pod Attached To Node Host Network

AnalysisType: rule
RuleID: "GCP.K8s.Pod.Attached.To.Node.Host.Network"
DisplayName: "GCP K8s Pod Attached To Node Host Network"
Enabled: false
Status: Deprecated
Filename: gcp_k8s_pod_attached_to_node_host_network.py
LogTypes:
  - GCP.AuditLog
Tags:
  - Deprecated
  - GCP
  - Optional
Severity: Medium
Description:
  This detection monitor for the creation of pods which are attached to the host's network.
  This allows a pod to listen to all network traffic for all deployed computer on that particular node and
  communicate with other compute on the network namespace. Attackers can use this to capture secrets passed in
  arguments or connections.
Reports:
  MITRE ATT&CK:
    - TA0004:T1611 # Escape to Host
Runbook:
  Investigate a reason of creating a pod which is attached to the host's network. Advise that it is discouraged
  practice. Create ticket if appropriate.
Reference: https://medium.com/snowflake/from-logs-to-detection-using-snowflake-and-panther-to-detect-k8s-threats-d72f70a504d7
Tests:
  - Name: triggers
    ExpectedResult: true
    Log:
      {
        "authorizationInfo":
          [
            {
              "granted": true,
              "permission": "io.k8s.core.v1.pods.create",
              "resource": "core/v1/namespaces/default/pods/nginx-test",
            },
          ],
        "protoPayload":
          {
            "methodName": "io.k8s.core.v1.pods.create",
            "request": { "spec": { "hostNetwork": true } },
          },
      }
  - Name: ignore
    ExpectedResult: false
    Log:
      {
        "authorizationInfo":
          [
            {
              "granted": true,
              "permission": "io.k8s.core.v1.pods.create",
              "resource": "core/v1/namespaces/default/pods/nginx-test",
            },
          ],
        "protoPayload":
          {
            "methodName": "io.k8s.core.v1.pods.create",
            "request": { "spec": { "hostNetwork": false } },
          },
      }


# ------ paired body: gcp_k8s_pod_attached_to_node_host_network.py ------

from panther_gcp_helpers import gcp_alert_context, is_gke_system_namespace, is_gke_system_principal


def rule(event):
    if event.deep_get("protoPayload", "methodName") not in (
        "io.k8s.core.v1.pods.create",
        "io.k8s.core.v1.pods.update",
        "io.k8s.core.v1.pods.patch",
    ):
        return False

    host_network = event.deep_walk("protoPayload", "request", "spec", "hostNetwork")
    if host_network is not True:
        return False

    # Check if this is a known GKE system service account
    principal_email = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default=""
    )
    if is_gke_system_principal(principal_email):
        return False

    # Check if this is in a system namespace
    resource_name = event.deep_get("protoPayload", "resourceName", default="")
    if is_gke_system_namespace(resource_name):
        return False

    return True


def title(event):
    actor = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )
    project_id = event.deep_get("resource", "labels", "project_id", default="<PROJECT_NOT_FOUND>")

    return (
        f"[GCP]: [{actor}] created or modified pod which is attached to the host's network "
        f"in project [{project_id}]"
    )


def dedup(event):
    actor = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )
    return actor


def alert_context(event):
    return gcp_alert_context(event)