Analytics BIOC Informational
✕

Kubelet server communication from a pod

The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Privilege Escalation (TA0004) Discovery (TA0007)
ATT&CK techniques: Escape to Host (T1611) Container and Resource Discovery (T1613)
Detector tags: Kubernetes - AGENT
Attacker's goals:

Usage of the Kubelet server to attempt a container breakout or escalate privileges.

Investigative actions:

Examine the process on the pod to understand its purpose.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Kubelet server communication from a pod by a first seen process Low (parent: Informational)