Elastic medium stable kql

GKE Pod Created With HostIPC

Detects GKE pod create, update, or patch events that enable host IPC namespace sharing. This exposes host inter-process communication mechanisms and can support privilege escalation. Controller-owned workloads are excluded.

View Source

Detection Logic

data_stream.dataset:gcp.audit and event.outcome:success and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.hostIPC:true and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")

False Positives

⚠ Administrators may enable hostIPC for legitimate debugging. Exclude trusted users or namespaces after baselining.

Field Validations

Loading…

Comments (0)

Loading comments...