GCP K8s Pod Using Host PID Namespace

AnalysisType: rule
RuleID: "GCP.K8s.Pod.Using.Host.PID.Namespace"
DisplayName: "GCP K8s Pod Using Host PID Namespace"
Enabled: false
Status: Deprecated
Filename: gcp_k8s_pod_using_host_pid_namespace.py
LogTypes:
  - GCP.AuditLog
Tags:
  - Deprecated
  - GCP
  - Optional
Severity: Medium
Description:
  This detection monitors for any pod creation or modification using the host PID namespace. The Host
  PID namespace enables a pod and its containers to have direct access and share the same view as of the host’s
  processes. This can offer a powerful escape hatch to the underlying host.
Runbook:
  Investigate a reason of creating a pod using the host PID namespace. Advise that it is discouraged
  practice. Create ticket if appropriate.
Reports:
  MITRE ATT&CK:
    - TA0004:T1611 # Escape to Host
    - TA0002:T1610 # Deploy Container
Reference: https://medium.com/snowflake/from-logs-to-detection-using-snowflake-and-panther-to-detect-k8s-threats-d72f70a504d7
Tests:
  - Name: triggers
    ExpectedResult: true
    Log:
      {
        "authorizationInfo":
          [
            {
              "granted": true,
              "permission": "io.k8s.core.v1.pods.create",
              "resource": "core/v1/namespaces/default/pods/nginx-test",
            },
          ],
        "protoPayload":
          {
            "methodName": "io.k8s.core.v1.pods.create",
            "request": { "spec": { "hostPID": true } },
          },
      }
  - Name: ignore
    ExpectedResult: false
    Log:
      {
        "authorizationInfo":
          [
            {
              "granted": true,
              "permission": "io.k8s.core.v1.pods.create",
              "resource": "core/v1/namespaces/default/pods/nginx-test",
            },
          ],
        "protoPayload":
          {
            "methodName": "io.k8s.core.v1.pods.create",
            "request": { "spec": { "hostPID": false } },
          },
      }


# ------ paired body: gcp_k8s_pod_using_host_pid_namespace.py ------

from panther_gcp_helpers import gcp_alert_context, is_gke_system_namespace, is_gke_system_principal

METHODS_TO_CHECK = [
    "io.k8s.core.v1.pods.create",
    "io.k8s.core.v1.pods.update",
    "io.k8s.core.v1.pods.patch",
]


def rule(event):
    method = event.deep_get("protoPayload", "methodName")
    request_host_pid = event.deep_get("protoPayload", "request", "spec", "hostPID")
    response_host_pid = event.deep_get("protoPayload", "response", "spec", "hostPID")
    if not ((request_host_pid is True or response_host_pid is True) and method in METHODS_TO_CHECK):
        return False

    # Check if this is a known GKE system service account
    principal_email = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default=""
    )
    if is_gke_system_principal(principal_email):
        return False

    # Check if this is in a system namespace
    resource_name = event.deep_get("protoPayload", "resourceName", default="")
    if is_gke_system_namespace(resource_name):
        return False

    return True


def title(event):
    actor = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )
    project_id = event.deep_get("resource", "labels", "project_id", default="<PROJECT_NOT_FOUND>")

    return (
        f"[GCP]: [{actor}] created or modified pod using the host PID namespace "
        f"in project [{project_id}]"
    )


def alert_context(event):
    return gcp_alert_context(event)