---
title: GKE Pod Created with a Sensitive hostPath Volume
description: Detects GKE pod create, update, or patch events that mount sensitive hostPath volumes such as the root filesystem, kubelet paths, or container runtime...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_hostpath_volume
products:
  - Elastic Security
---

# GKE Pod Created with a Sensitive hostPath Volume
Detects GKE pod create, update, or patch events that mount sensitive hostPath volumes such as the root filesystem,
kubelet paths, or container runtime sockets. This can enable container escape and credential theft. System identities
and controller-owned workloads are excluded.
**Rule type**: query
**Rule indices**:
- logs-gcp.audit-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: ``
**Maximum alerts per execution**: 100
**References**:
- [[https://kubernetes.io/docs/concepts/storage/volumes/#hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)
- [[https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216](https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216)](https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Privilege Escalation
- Tactic: Execution
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Fast
- Profile: Recommended
- Threat: Container Escape
- Rule Type: Custom Query (KQL)
- Platform: GCP
- Domain: Containers
- Platform: Kubernetes

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating GKE Pod Created with a Sensitive hostPath Volume

Review `gcp.audit.request.spec.volumes.hostPath.path` and whether the mount is required for the workload.

### Investigation steps

- Confirm the hostPath and container images in the audit request.
- Review `user.email`, namespace, and follow-on secret or exec activity.


### False positives

- Platform DaemonSets mounting /proc or kubelet paths; validate against known agents.


## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

## Rule Query

```kuery
data_stream.dataset:gcp.audit and event.outcome:success and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.volumes.hostPath.path:(
  "/" or "/proc" or "/root" or "/var" or "/var/run" or "/var/run/docker.sock" or "/var/run/crio/crio.sock" or
  "/var/run/cri-dockerd.sock" or "/var/lib/kubelet" or "/var/lib/kubelet/pki" or "/var/lib/docker/overlay2" or "/etc" or
  "/etc/kubernetes" or "/etc/kubernetes/manifests" or "/etc/kubernetes/pki" or "/home/admin"
) and not user.email:system\:* and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Escape to Host
  - Id: T1611
  - Reference URL: [[https://attack.mitre.org/techniques/T1611/](https://attack.mitre.org/techniques/T1611/)](https://attack.mitre.org/techniques/T1611/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Deploy Container
  - Id: T1610
  - Reference URL: [[https://attack.mitre.org/techniques/T1610/](https://attack.mitre.org/techniques/T1610/)](https://attack.mitre.org/techniques/T1610/)