DevOps & Infrastructure

Detecting Privilege Escalation In Kubernetes Pods

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.

Publisher / source

Cybersecurity Skills (Community)

Upstream record

mukul975/Anthropic-Cybersecurity-Skills

Version

Version 4

Published

2026-06-20

Publication review

Approved for publication

Content fingerprint

fbadde97dd456a82afa3e53e571d83cc0d84c8059d099d6e309349a7c561121b