
Summary
The 'Kubernetes Pod Using Host IPC Namespace' detection rule monitors Kubernetes pods that are configured with the 'hostIPC' property set to true. This configuration allows a pod to access the host's inter-process communication (IPC) namespace, effectively breaking the isolation between the pod and the host. This can pose security risks, as malicious actors may exploit this access to communicate with or manipulate host processes or other containers using the same IPC namespace. The rule is designed to detect such potentially dangerous configurations, which may indicate privilege escalation or attempts at container escape. Organizations are encouraged to input proper access controls and review their workload needs concerning IPC settings.
Categories
- Kubernetes
- Cloud
- Containers
Data Sources
- Pod
- Container
ATT&CK Techniques
- T1611
- T1562
Created: 2026-02-18