Sigma rule: Privileged Container Deployed

Rule

Title

Privileged Container Deployed

Status

test

Level

low

Author

Leo Tsaousis (@laripping)

Date

2024-03-26

File

rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks.
A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

Log source

product

kubernetes

service

audit

category

application

Detection

selection:
    verb: 'create'
    objectRef.resource: 'pods'
    capabilities: '*' # Note: Add the "exists" when it's implemented in SigmaHQ/Aurora
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.t1611
• attack.privilege-escalation

MITRE ATT&CK ids this rule names

• T1611

References

• https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
• https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer
• https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html
• https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml