Kubernetes Pod With HostPath Volume Mount

Description

This detection monitors for pod creation with a hostPath volume mount. The attachment to a node's volume can allow for privilege escalation through underlying vulnerabilities or it can open up possibilities for data exfiltration or unauthorized file access. It is very rare to see this being a pod requirement. System service accounts in the kube-system namespace are excluded to prevent false positives from legitimate system components.

Query · python

from panther_kubernetes_helpers import (
    get_hostpath_paths,
    get_pod_context_fields,
    get_pod_name,
    has_hostpath_volume,
    is_failed_request,
    is_sensitive_hostpath,
    is_system_namespace,
    is_system_principal,
    k8s_alert_context,
)


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    namespace = event.udm("namespace")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check pod creation events
    if verb != "create" or resource != "pods":
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals creating pods in system namespaces (legitimate)
    # but alert on system principals in user namespaces (malicious Deployments)
    # and alert on user-created pods in system namespaces (suspicious)
    if is_system_principal(username) and is_system_namespace(namespace):
        return False

    # Check for hostPath volumes
    volumes = event.udm("volumes") or []
    if has_hostpath_volume(volumes):
        return True

    return False


def severity(event):
    volumes = event.udm("volumes") or []
    paths = get_hostpath_paths(volumes)

    for path in paths:
        if is_sensitive_hostpath(path):
            return "HIGH"

    return "DEFAULT"


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    name = get_pod_name(event)

    volumes = event.udm("volumes") or []
    paths = get_hostpath_paths(volumes)
    paths_str = ", ".join(paths) if paths else "unknown"

    return (
        f"[{username}] created pod [{namespace}/{name}] with hostPath volume mount "
        f"[{paths_str}]"
    )


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    return f"hostpath_volume_{username}_{namespace}"


def alert_context(event):
    volumes = event.udm("volumes") or []
    pod_context = get_pod_context_fields(event)

    return k8s_alert_context(
        event,
        extra_fields={
            **pod_context,
            "hostpath_paths": get_hostpath_paths(volumes),
        },
    )

Analyst notes

Review all pod creation events by the username in the 24 hours before the alert to establish baseline deployment behavior
Check if the hostPath volume is mounted from sensitive paths (/, /var, /sys, /proc, /etc) which pose higher security risk
Search for other hostPath volume mounts by this user in the past 30 days and compare the paths being accessed to identify patterns

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: 2026-02-17
Modified: 2026-04-07
Authored by: panther-labs
Source ID
Upstream: rules/kubernetes_rules/k8s_pod_hostpath_volume.yml
Type: rule
Version: 2
Data sources: Amazon.EKS.AuditAzure.MonitorActivityGCP.AuditLog

ATT&CK

TA0004TA0010 T1041 T1611