LoFP / monitoring agents and cni components may require hostnetwork. exclude known platform identities after review.

Techniques

• T1610
• T1611

Sample rules

GKE Pod Created With HostNetwork

• source: elastic
• technicques:
  • T1610
  • T1611

Description

Detects GKE pod create, update, or patch events that enable host network namespace sharing. HostNetwork grants access to the node network stack and can bypass namespace network policies. System identities and controller-owned workloads are excluded.

Detection logic

data_stream.dataset:gcp.audit and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.hostNetwork:true and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet") and
not user.email:system\:*