Analytics BIOC Informational
✕

Kubernetes Pod Created with host Inter Process Communications (IPC) namespace

An identity created a Kubernetes pod with the host Inter Process Communications (IPC) namespace. This may indicate an adversary attempting to access data used by other pods that use the host's IPC namespace.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs
ATT&CK tactics: Privilege Escalation (TA0004) Execution (TA0002)
ATT&CK techniques: Escape to Host (T1611) Deploy Container (T1610)
Detector tags: Kubernetes - API
Attacker's goals:

Access data used by other pods that use the host's IPC namespace.

Investigative actions:

Check the identity's role designation in the organization. Inspect for any files in the /dev/shm shared memory location. Inspect for any IPC facilities being used with /usr/bin/ipcs.

Test period:
N/A (single event)
Deduplication:
5 Days
3 variations:
  • Kubernetes Pod Created with host Inter Process Communications (IPC) namespace for the first time in the cluster Low (parent: Informational)
  • Kubernetes Pod Created with host Inter Process Communications (IPC) namespace for the first time in the namespace Low (parent: Informational)
  • Kubernetes Pod Created with host Inter Process Communications (IPC) namespace for the first time by the identity Low (parent: Informational)