Sigma rule: Creation Of Pod In System Namespace

Rule

Title

Creation Of Pod In System Namespace

Status

test

Level

medium

Author

Leo Tsaousis (@laripping)

Date

2024-03-26

File

rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.

Log source

product

kubernetes

service

audit

category

application

Detection

selection:
    verb: 'create'
    objectRef.resource: 'pods'
    objectRef.namespace: kube-system
condition: selection

False positives (as the rule lists them)

• System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace

Tags

• attack.stealth
• attack.t1036.005

MITRE ATT&CK ids this rule names

• T1036.005

References

• https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml