Kubernetes Privileged Pod Created

Description

Detects creation of privileged pods across Kubernetes clusters. Privileged pods have full access to the host's namespace and devices, have the ability to exploit the kernel, have dangerous linux capabilities, and can be a powerful launching point for further attacks. In the event of a successful container escape where a user is operating with root privileges, the attacker retains this role on the node.

Query · python

from panther_kubernetes_helpers import (
    get_pod_context_fields,
    get_pod_name,
    is_failed_request,
    is_privileged_container,
    is_system_namespace,
    is_system_principal,
    k8s_alert_context,
)


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    namespace = event.udm("namespace")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check pod creation events
    if verb != "create" or resource != "pods":
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals creating pods in system namespaces (legitimate)
    # but alert on system principals in user namespaces (malicious Deployments)
    # and alert on user-created pods in system namespaces (suspicious)
    if is_system_principal(username) and is_system_namespace(namespace):
        return False

    # Check request object for privileged containers
    containers = event.udm("containers") or []
    if is_privileged_container(containers):
        return True

    return False


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    name = get_pod_name(event)

    return f"[{username}] created a privileged pod [{namespace}/{name}]"


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    return f"privileged_pod_{username}"


def alert_context(event):
    return k8s_alert_context(event, extra_fields=get_pod_context_fields(event))

Analyst notes

Check if the username who created the privileged pod has a history of deploying system infrastructure in the past 90 days
Review all API calls by this username in the 6 hours before the alert to understand context and related activity
Query for other privileged pods created by the same user in the past 30 days to identify if this is an established pattern

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-02-17
Modified: 2026-04-07
Authored by: panther-labs
Source ID
Upstream: rules/kubernetes_rules/k8s_privileged_pod_created.yml
Type: rule
Version: 2
References: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
Data sources: Amazon.EKS.AuditAzure.MonitorActivityGCP.AuditLog

ATT&CK

TA0004 T1548.003