<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-kubernetes-privilege-escalation
description: >-
  Detect and prevent Kubernetes privilege escalation paths including RBAC
  abuse, container escape, hostPath mounts, privileged containers, and
  node-to-cluster pivoting techniques.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - privilege-escalation
  - rbac
  - container-escape
  - pod-security
  - opa-gatekeeper
  - attack-path
  - cis-benchmark
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1611"]
---

# Detecting Kubernetes Privilege Escalation

## Overview

Kubernetes clusters present multiple privilege escalation vectors — overly
permissive RBAC, privileged containers, hostPath mounts, writable hostPID,
and node credential theft. This skill detects escalation paths and enforces
Pod Security Standards to prevent container breakout.

Mode: `[MODE: RED]` — Map escalation paths (T1611). `[MODE: BLUE]` — Detect and prevent escalation.

## Prerequisites

| Requirement | Details |
|---|---|
| kubectl with cluster-admin or read access | Required |
| Audit logging enabled on API server | Required |
| Pod Security Admission or OPA Gatekeeper deployed | Required |

## Key Concepts

### Detect Privileged Containers

```bash
# Find privileged containers
kubectl get pods -A -o json | \
  jq '.items[] | select(
    .spec.containers[].securityContext.privileged == true
  ) | {namespace: .metadata.namespace, pod: .metadata.name}'

# Find containers running as root
kubectl get pods -A -o json | \
  jq '.items[] | select(
    .spec.securityContext.runAsNonRoot != true and
    (.spec.containers[].securityContext.runAsNonRoot != true)
  ) | {namespace: .metadata.namespace, pod: .metadata.name}'
```

### RBAC Escalation Audit

```bash
# Find ClusterRoleBindings granting cluster-admin
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name == "cluster-admin") |
  {name: .metadata.name, subjects: .subjects}'

# Find roles with wildcard verbs or resources
kubectl get clusterroles -o json | \
  jq '.items[] | select(.rules[]? |
    (.verbs[]? == "*") or (.resources[]? == "*")
  ) | .metadata.name'

# Check for escalate/bind/impersonate permissions
kubectl get clusterroles -o json | \
  jq '.items[] | select(.rules[]? |
    .verbs[]? | test("escalate|bind|impersonate")
  ) | .metadata.name'
```

### Dangerous Volume Mounts

```bash
# Find hostPath mounts
kubectl get pods -A -o json | \
  jq '.items[] | select(.spec.volumes[]?.hostPath) |
  {namespace: .metadata.namespace, pod: .metadata.name,
    paths: [.spec.volumes[] | select(.hostPath) | .hostPath.path]}'

# Find hostPID / hostNetwork pods
kubectl get pods -A -o json | \
  jq '.items[] | select(.spec.hostPID == true or .spec.hostNetwork == true) |
  {namespace: .metadata.namespace, pod: .metadata.name}'
```

### Pod Security Standards Enforcement

```yaml
# Enforce restricted PSS at namespace level
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/privesc-audit.json | jq '.findings[] | select(.severity == "critical")'
kubectl label namespace production pod-security.kubernetes.io/enforce=restricted
```

## Detection

```yaml
title: Kubernetes Privilege Escalation Detection
id: b930c204-0a41-4595-ab9d-6ddc4dc9972b
status: experimental
description: Detects suspicious activity related to detecting kubernetes privilege escalation techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1611
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Kubernetes Privilege Escalation Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1611 |

## Verification

- [ ] No privileged containers in production namespaces
- [ ] Pod Security Standards enforced at restricted level
- [ ] cluster-admin bound only to break-glass accounts
- [ ] No wildcard RBAC rules outside system namespaces
- [ ] hostPath, hostPID, hostNetwork disabled for workloads
- [ ] Audit log alerts for privilege escalation attempts

## References

- [Kubernetes Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/)
- [MITRE ATT&CK T1611 — Escape to Host](https://attack.mitre.org/techniques/T1611/)
- [RBAC Good Practices](https://kubernetes.io/docs/concepts/security/rbac-good-practices/)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)
