<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-privileged-container-abuse
description: >-
  Detect and respond to privileged container abuse including host filesystem
  access, kernel module loading, device manipulation, and capability exploitation
  using Falco, OPA, and audit logging.
domain: cybersecurity
subdomain: container-security
tags:
  - privileged-containers
  - capability-abuse
  - falco
  - detection
  - host-access
  - kernel-modules
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1611"]
---

# Detecting Privileged Container Abuse

## Overview

Privileged containers run without kernel-enforced isolation and can access all
host devices, filesystems, and capabilities. This skill covers detection of
abuse patterns — host file reads, kernel module loading, device manipulation,
and capability exploitation — using Falco rules, admission policies with
Kyverno, and cluster-wide configuration audits.

Mode: `[MODE: BLUE]` — Defensive runtime detection and prevention.

## Prerequisites

- Falco >= 0.37 for runtime detection
- kubectl with cluster-admin access
- OPA Gatekeeper or Kyverno for prevention
- auditd on host nodes

## Key Concepts

### Privileged Container Risks

| Capability | Risk | Detection |
|-----------|------|-----------|
| `--privileged` | Full host access | Falco, audit logs |
| `SYS_ADMIN` | Mount, namespace ops | Syscall monitoring |
| `SYS_PTRACE` | Process debugging | ptrace audit |
| `NET_ADMIN` | Network manipulation | Network monitoring |
| `SYS_RAWIO` | Direct I/O access | Device monitoring |

### Detecting Privileged Containers

```bash
# Find all privileged containers
kubectl get pods --all-namespaces -o json | jq '
  [.items[] | {
    namespace: .metadata.namespace,
    pod: .metadata.name,
    containers: [.spec.containers[] | select(
      .securityContext.privileged == true
    ) | .name]
  } | select(.containers | length > 0)]'

# Find dangerous capabilities
kubectl get pods --all-namespaces -o json | jq '
  [.items[] | {
    namespace: .metadata.namespace,
    pod: .metadata.name,
    containers: [.spec.containers[] | select(
      .securityContext.capabilities.add != null
    ) | {name, caps: .securityContext.capabilities.add}]
  } | select(.containers | length > 0)]'
```

### Falco Detection Rules

```yaml
- rule: Privileged Container File System Access
  desc: Detects privileged container accessing host sensitive files
  condition: >
    open_read and container and container.privileged=true
    and (fd.name startswith /etc/shadow
         or fd.name startswith /etc/kubernetes
         or fd.name startswith /var/lib/kubelet)
  output: >
    Privileged container reading sensitive host file
    (user=%user.name file=%fd.name container=%container.name)
  priority: CRITICAL
  tags: [container, privileged, T1005, mitre_collection]

- rule: Kernel Module Load in Container
  desc: Detects loading kernel modules from within a container
  condition: >
    spawned_process and container
    and (proc.name = insmod or proc.name = modprobe)
  output: >
    Kernel module loading attempt in container
    (user=%user.name command=%proc.cmdline container=%container.name)
  priority: CRITICAL
  tags: [container, privileged, T1547, mitre_persistence]
```

### Prevention with Kyverno

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-privileged
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-privileged-containers
      match:
        any:
          - resources:
              kinds: [Pod]
      validate:
        message: "Privileged containers are forbidden."
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: "false"
```

## Workflow

### Step 1: Audit Privileged Containers

```bash
node scripts/agent.js --audit --output /tmp/privileged-audit.json
```

### Step 2: Deploy Detection Rules

```bash
kubectl apply -f privileged-detection-rules.yaml
```

### Step 3: Apply Prevention Policies

```bash
kubectl apply -f deny-privileged-policy.yaml
```

## Detection

```yaml
title: Privileged Container Abuse Detection
id: 2c0447dd-7edd-4fa3-a200-d0679d120e75
status: experimental
description: Detects suspicious activity related to detecting privileged container abuse techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1611
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```

## Verification

- [ ] All privileged containers identified and justified
- [ ] Falco alerts on host file access from privileged containers
- [ ] Kernel module loading blocked and alerted
- [ ] Admission controller denies new privileged pods
- [ ] Dangerous capabilities (SYS_ADMIN, SYS_PTRACE) restricted

## References

- [Kubernetes Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
- [Linux Capabilities — man capabilities(7)](https://man7.org/linux/man-pages/man7/capabilities.7.html)
- [Falco Rules — Privileged Containers](https://falco.org/docs/rules/)
- [CIS Docker Benchmark 5.4 — Privileged Mode](https://www.cisecurity.org/benchmark/docker)
- [MITRE ATT&CK T1610 — Deploy Container](https://attack.mitre.org/techniques/T1610/)
