What it does. Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-privilege-escalation-in-kubernetes-pods, or copy the skill folder into ~/.claude/skills/detecting-privilege-escalation-in-kubernetes-pods/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md

SKILL.md (verbatim)

name: detecting-privilege-escalation-in-kubernetes-pods
description: >-
  Detects and prevents privilege escalation inside Kubernetes pods by combining admission
  control (OPA policies), runtime monitoring (Falco), and audit log analysis of security
  contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as
  root or privileged, hardening workloads against in-pod escalation, or hunting for containers
  exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities,
  securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and
  service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.
domain: cybersecurity
subdomain: container-security
tags:
- kubernetes
- privilege-escalation
- security-context
- capabilities
- detection
- pod-security
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Restore Access
- Password Authentication
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525
- T1068

Detecting Privilege Escalation in Kubernetes Pods

Overview

Privilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).

When to Use

• When investigating security incidents that require detecting privilege escalation in kubernetes pods
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Kubernetes cluster v1.25+ (Pod Security Admission support)
• kubectl with cluster-admin access
• Falco or similar runtime security tool
• OPA Gatekeeper or Kyverno for admission policies

Privilege Escalation Vectors in Kubernetes

Detection with Admission Control

Pod Security Admission (Built-in)

# Enforce restricted policy on namespace
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

OPA Gatekeeper Policies

# Block dangerous capabilities
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sdangerouspriv
spec:
  crd:
    spec:
      names:
        kind: K8sDangerousPriv
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sdangerouspriv

        dangerous_caps := {"SYS_ADMIN", "SYS_PTRACE", "SYS_MODULE", "DAC_OVERRIDE", "NET_ADMIN", "NET_RAW"}

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          cap := container.securityContext.capabilities.add[_]
          dangerous_caps[cap]
          msg := sprintf("Container %v adds dangerous capability: %v", [container.name, cap])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := sprintf("Container %v runs in privileged mode", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.allowPrivilegeEscalation == true
          msg := sprintf("Container %v allows privilege escalation", [container.name])
        }

        violation[{"msg": msg}] {
          input.review.object.spec.hostPID == true
          msg := "Pod uses host PID namespace"
        }

        violation[{"msg": msg}] {
          input.review.object.spec.hostNetwork == true
          msg := "Pod uses host network"
        }

Runtime Detection with Falco

# /etc/falco/rules.d/privesc-detection.yaml
- rule: Setuid Binary Execution in Container
  desc: Detect execution of setuid/setgid binaries in a container
  condition: >
    spawned_process and container and
    (proc.name in (su, sudo, newgrp, chsh, passwd) or
     proc.is_exe_upper_layer=true)
  output: >
    Setuid/setgid binary executed in container
    (user=%user.name container=%container.name image=%container.image.repository
     command=%proc.cmdline parent=%proc.pname)
  priority: WARNING
  tags: [container, privilege-escalation, T1548]

- rule: Capability Gained in Container
  desc: Detect when a process gains elevated capabilities
  condition: >
    evt.type = capset and container and
    evt.arg.cap != ""
  output: >
    Process gained capabilities in container
    (container=%container.name image=%container.image.repository
     capabilities=%evt.arg.cap command=%proc.cmdline)
  priority: WARNING
  tags: [container, privilege-escalation, T1548.001]

- rule: Container with Dangerous Capabilities Started
  desc: Detect container launched with dangerous capabilities
  condition: >
    container_started and container and
    (container.image.repository != "registry.k8s.io/pause") and
    (container.cap_effective contains SYS_ADMIN or
     container.cap_effective contains SYS_PTRACE or
     container.cap_effective contains SYS_MODULE)
  output: >
    Container with dangerous capabilities
    (container=%container.name image=%container.image.repository
     caps=%container.cap_effective)
  priority: CRITICAL
  tags: [container, privilege-escalation, T1068]

- rule: Write to /etc/passwd in Container
  desc: Detect writes to /etc/passwd inside container
  condition: >
    open_write and container and fd.name = /etc/passwd
  output: >
    Write to /etc/passwd in container
    (container=%container.name image=%container.image.repository
     command=%proc.cmdline user=%user.name)
  priority: CRITICAL
  tags: [container, privilege-escalation, T1136]

Kubernetes Audit Log Detection

# audit-policy.yaml - Capture privilege escalation events
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  # Log pod creation with security context details
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["pods"]
    verbs: ["create", "update", "patch"]

  # Log privilege escalation attempts
  - level: RequestResponse
    resources:
      - group: "rbac.authorization.k8s.io"
        resources: ["clusterroles", "clusterrolebindings", "roles", "rolebindings"]
    verbs: ["create", "update", "patch", "bind", "escalate"]

  # Log service account token requests
  - level: Metadata
    resources:
      - group: ""
        resources: ["serviceaccounts/token"]
    verbs: ["create"]

Query Audit Logs for Privilege Escalation

# Find pods created with privileged security context
kubectl logs -n kube-system kube-apiserver-* | \
  jq 'select(.verb == "create" and .objectRef.resource == "pods") |
  select(.requestObject.spec.containers[].securityContext.privileged == true)'

# Find RBAC escalation attempts
kubectl logs -n kube-system kube-apiserver-* | \
  jq 'select(.objectRef.resource == "clusterrolebindings" and .verb == "create")'

Investigation Playbook

# Check pod security context
kubectl get pod <pod-name> -n <ns> -o jsonpath='{.spec.containers[*].securityContext}'

# Check effective capabilities
kubectl exec <pod-name> -n <ns> -- cat /proc/1/status | grep -i cap

# List pods running as root
kubectl get pods --all-namespaces -o json | \
  jq '.items[] | select(.spec.containers[].securityContext.runAsUser == 0 or .spec.containers[].securityContext.privileged == true) | {name: .metadata.name, ns: .metadata.namespace}'

# Check for hostPath volumes
kubectl get pods --all-namespaces -o json | \
  jq '.items[] | select(.spec.volumes[]?.hostPath != null) | {name: .metadata.name, ns: .metadata.namespace, paths: [.spec.volumes[].hostPath.path]}'

Best Practices

1. Enable Pod Security Admission at restricted level for production namespaces
2. Drop ALL capabilities and add back only what is needed
3. Set allowPrivilegeEscalation: false on all containers
4. Run as non-root (runAsNonRoot: true, runAsUser > 0)
5. Disable automountServiceAccountToken unless API access is needed
6. Monitor with Falco for runtime privilege escalation attempts
7. Audit RBAC changes with Kubernetes audit logging
8. Use seccomp profiles to restrict syscalls

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Privilege Escalation Detection Checklist

Prevention Controls

• Pod Security Admission set to restricted on production namespaces
• OPA Gatekeeper constraints block privileged containers
• Default security context enforced via mutation webhook
• Dangerous capabilities blocked at admission

Detection Controls

• Falco rules deployed for privilege escalation patterns
• Kubernetes audit logging enabled
• Alerts configured for CRITICAL findings
• Regular cluster scans scheduled

Dangerous Configurations to Block

references/api-reference.md (verbatim)

API Reference: Detecting Privilege Escalation in Kubernetes Pods

Security Context Checks

Dangerous Capabilities

kubectl Audit Commands

kubectl get pods -A -o json | jq '.items[] | select(.spec.containers[].securityContext.privileged==true)'
kubectl auth can-i --list --as=system:serviceaccount:ns:sa

Pod Security Standards

apiVersion: v1
kind: Namespace
metadata:
  labels:
    pod-security.kubernetes.io/enforce: restricted

Falco Rules

- rule: Pod with Privileged Container
  condition: kevt and kcreate and container.privileged=true
  priority: CRITICAL

CLI Usage

python agent.py --namespace default
python agent.py --json-file pods.json

references/standards.md (verbatim)

Standards - Detecting Privilege Escalation in Kubernetes Pods

MITRE ATT&CK for Containers

CIS Kubernetes Benchmark v1.8

• 5.2.1-5.2.9: Pod Security Standards
• 5.7.3: Apply security context to pods

NIST SP 800-190

• Section 4.3: Container runtime vulnerabilities
• Section 5.4: Runtime monitoring for privilege escalation

Pod Security Standards

references/workflows.md (verbatim)

Workflow - Detecting Privilege Escalation in Kubernetes Pods

Phase 1: Assess Current State

# Find privileged pods
kubectl get pods -A -o json | jq '[.items[] | select(.spec.containers[].securityContext.privileged==true) | {name:.metadata.name, ns:.metadata.namespace}]'

# Find pods running as root
kubectl get pods -A -o json | jq '[.items[] | select(.spec.securityContext.runAsUser==0 or .spec.containers[].securityContext.runAsUser==0) | {name:.metadata.name, ns:.metadata.namespace}]'

# Find hostPath mounts
kubectl get pods -A -o json | jq '[.items[] | select(.spec.volumes[]?.hostPath!=null) | {name:.metadata.name, ns:.metadata.namespace}]'

Phase 2: Deploy Prevention

1. Apply Pod Security Admission labels to namespaces
2. Deploy OPA Gatekeeper constraints
3. Test with non-compliant pods (should be rejected)

Phase 3: Deploy Detection

1. Install Falco with privilege escalation rules
2. Enable Kubernetes audit logging
3. Configure alerts to SIEM

Phase 4: Respond to Alerts

1. Identify compromised pod
2. Check container security context
3. Review process list and capabilities
4. Isolate with network policy
5. Capture forensic data
6. Delete compromised pod

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.