detecting-privilege-escalation-in-kubernetes-pods

What problem does it solve?

Privilege escalation in Kubernetes pods occurs when containers gain elevated access, enabling host compromise or broader cluster impact. This skill provides a framework to detect and prevent such misconfigurations by inspecting securityContext fields, capabilities, host namespace usage, and related indicators.

Core Features & Use Cases

• Inspect pod security contexts (privileged, runAsUser, allowPrivilegeEscalation) across pods and init containers
• Detect dangerous capabilities and host-level access (hostPID, hostNetwork, hostIPC)
• Provide guidance for prevention (admission controls, Falco rules, and audit policy references) and for investigation

Quick Start

Run the agent to audit pods across your cluster and generate a report.