LoFP / administrators may enable hostipc for legitimate debugging. exclude trusted users or namespaces after baselining.

Techniques

• T1610
• T1611

Sample rules

GKE Pod Created With HostIPC

• source: elastic
• technicques:
  • T1610
  • T1611

Description

Detects GKE pod create, update, or patch events that enable host IPC namespace sharing. This exposes host inter-process communication mechanisms and can support privilege escalation. Controller-owned workloads are excluded.

Detection logic

data_stream.dataset:gcp.audit and event.outcome:success and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.hostIPC:true and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")