AnalysisType: rule
RuleID: "Kubernetes.Pod.Host.IPC"
DisplayName: "Kubernetes Pod Using Host IPC Namespace"
Enabled: true
Filename: k8s_pod_host_ipc.py
LogTypes:
- Amazon.EKS.Audit
- Azure.MonitorActivity
- GCP.AuditLog
Tags:
- Kubernetes
- Security Control
- Privilege Escalation
- Container Escape
- Unified Detection
Severity: Medium
Description: >
This detection monitors for pods created with hostIPC set to true, which allows the pod to
use the host's IPC namespace. This breaks isolation between the pod and the host system,
giving the pod direct access to shared memory segments, semaphores, and message queues on
the host. Attackers can abuse this to communicate with or interfere with processes on the
host system or other containers using the same IPC namespace.
Runbook: |
1. Review all pod creation events by the username in the 24 hours before the alert to establish normal deployment patterns
2. Determine if the hostIPC setting is required for legitimate inter-process communication needs for this specific workload
3. Search for other pods with hostIPC enabled deployed by this user across all clusters in the past 30 days
Reports:
MITRE ATT&CK:
- TA0004:T1611 # Privilege Escalation: Escape to Host
- TA0005:T1562 # Defense Evasion: Impair Defenses
Reference: >
- https://kubernetes.io/docs/concepts/security/pod-security-standards/
- https://www.fairwinds.com/blog/kubernetes-basics-tutorial-host-ipc-should-not-be-configured
DedupPeriodMinutes: 60
SummaryAttributes:
- username
- namespace
- p_source_label
Tests:
- Name: EKS Pod with HostIPC
ExpectedResult: true
Log:
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"verb": "create",
"user": {"username": "developer@example.com"},
"sourceIPs": ["1.2.3.4"],
"userAgent": "kubectl/v1.28.0",
"objectRef": {
"resource": "pods",
"namespace": "default",
"name": "debug-pod",
"apiVersion": "v1"
},
"responseStatus": {"code": 201},
"requestObject": {
"kind": "Pod",
"metadata": {"name": "debug-pod", "namespace": "default"},
"spec": {
"hostIPC": true,
"containers": [{
"name": "debug",
"image": "busybox"
}]
}
},
"p_log_type": "Amazon.EKS.Audit",
"p_source_label": "eks-cluster"
}
- Name: AKS Pod with HostIPC
ExpectedResult: true
Log:
{
"p_log_type": "Azure.MonitorActivity",
"category": "kube-audit",
"operationName": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
"properties": {
"log": "{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"verb\":\"create\",\"user\":{\"username\":\"admin@example.com\"},\"sourceIPs\":[\"10.0.0.1\"],\"objectRef\":{\"resource\":\"pods\",\"namespace\":\"default\",\"name\":\"ipc-test\"},\"responseStatus\":{\"code\":201},\"requestObject\":{\"spec\":{\"hostIPC\":true,\"containers\":[{\"name\":\"test\",\"image\":\"alpine\"}]}}}"
},
"p_source_label": "aks-cluster"
}
- Name: GKE Pod with HostIPC
ExpectedResult: true
Log:
{
"protoPayload": {
"authenticationInfo": {"principalEmail": "user@company.com"},
"authorizationInfo": [{
"granted": true,
"permission": "io.k8s.core.v1.pods.create",
"resource": "core/v1/namespaces/default/pods/shared-mem"
}],
"methodName": "io.k8s.core.v1.pods.create",
"requestMetadata": {"callerIP": "1.2.3.4"},
"resourceName": "core/v1/namespaces/default/pods/shared-mem",
"serviceName": "k8s.io",
"request": {
"kind": "Pod",
"spec": {
"hostIPC": true,
"containers": [{
"name": "app",
"image": "myapp:latest"
}]
}
}
},
"resource": {
"type": "k8s_cluster",
"labels": {"project_id": "test-project"}
},
"p_log_type": "GCP.AuditLog",
"p_source_label": "gke-cluster"
}
- Name: Pod without HostIPC
ExpectedResult: false
Log:
{
"kind": "Event",
"verb": "create",
"objectRef": {"resource": "pods", "namespace": "default"},
"responseStatus": {"code": 201},
"requestObject": {
"spec": {
"hostIPC": false,
"containers": [{"name": "app", "image": "nginx"}]
}
},
"p_log_type": "Amazon.EKS.Audit"
}
- Name: System Namespace with HostIPC (Excluded)
ExpectedResult: false
Log:
{
"kind": "Event",
"verb": "create",
"user": {"username": "system:serviceaccount:kube-system:daemon"},
"objectRef": {"resource": "pods", "namespace": "kube-system"},
"responseStatus": {"code": 201},
"requestObject": {
"spec": {
"hostIPC": true,
"containers": [{"name": "agent"}]
}
},
"p_log_type": "Amazon.EKS.Audit"
}
- Name: Pod Creation Failed
ExpectedResult: false
Log:
{
"kind": "Event",
"verb": "create",
"objectRef": {"resource": "pods", "namespace": "default"},
"responseStatus": {"code": 403},
"requestObject": {
"spec": {
"hostIPC": true,
"containers": [{"name": "test"}]
}
},
"p_log_type": "Amazon.EKS.Audit"
}
# ------ paired body: k8s_pod_host_ipc.py ------
from panther_kubernetes_helpers import (
get_pod_context_fields,
get_pod_name,
is_failed_request,
is_system_namespace,
is_system_principal,
k8s_alert_context,
)
def rule(event):
verb = event.udm("verb")
resource = event.udm("resource")
namespace = event.udm("namespace")
username = event.udm("username")
response_status = event.udm("responseStatus")
# Only check pod creation events
if verb != "create" or resource != "pods":
return False
# Skip failed requests
if is_failed_request(response_status):
return False
# Exclude system principals creating pods in system namespaces (legitimate)
# but alert on system principals in user namespaces (malicious Deployments)
# and alert on user-created pods in system namespaces (suspicious)
if is_system_principal(username) and is_system_namespace(namespace):
return False
# Check if hostIPC is enabled
host_ipc = event.udm("hostIPC")
if host_ipc is True:
return True
return False
def title(event):
username = event.udm("username") or "<UNKNOWN_USER>"
namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
name = get_pod_name(event)
return f"[{username}] created pod [{namespace}/{name}] with host IPC enabled "
def dedup(event):
username = event.udm("username") or "<UNKNOWN_USER>"
namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
return f"k8s_host_ipc_{username}_{namespace}"
def alert_context(event):
return k8s_alert_context(event, extra_fields=get_pod_context_fields(event))