Sigma rule: Container With A hostPath Mount Created

Rule

Title

Container With A hostPath Mount Created

Status

test

Level

low

Author

Leo Tsaousis (@laripping)

Date

2024-03-26

File

rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of a container with a hostPath mount.
A hostPath volume mounts a directory or a file from the node to the container.
Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Log source

product

kubernetes

service

audit

category

application

Detection

selection:
    verb: 'create'
    objectRef.resource: 'pods'
    hostPath: '*' # Note: Add the "exists" when it's implemented in SigmaHQ/Aurora
condition: selection

False positives (as the rule lists them)

• The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.

Tags

• attack.t1611
• attack.privilege-escalation

MITRE ATT&CK ids this rule names

• T1611

References

• https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
• https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml