AN1304
Analytic 1304
Containers
Correlate the creation or modification of containers using restart policies (e.g., 'always') or DaemonSets with elevated host access, service account misuse, or privileged container contexts. Watch for manipulation of systemd units involving containers or pod scheduling targeting specific nodes or namespaces.
auditd:SYSCALL
execve
systemd:unit
container run with restart policy set to 'always' or 'unless-stopped'
kubernetes:audit
create
kubernetes:audit
create
[restartPolicy]
Tune for environments that legitimately use 'always' or 'unless-stopped' in trusted containers
[targetNamespace]
Scope detection to high-risk namespaces (e.g., kube-system)
[nodeSelector|nodeName]
Adjust if targeting known cluster configurations or test environments
[unitFilePath]
Adapt to your OS/systemd hierarchy and container binary references
[TimeWindow]
Adjust temporal correlation (e.g., container launch → privilege escalation)