Fission Container Executor PodSpec Injection - Node Escape Attempt

let SuspiciousPodSpecFields = dynamic(["hostPID", "hostNetwork", "hostIPC", "privileged", "hostPath", "allowPrivilegeEscalation"]);
let FissionNamespaces = dynamic(["fission", "fission-function", "fission-builder"]);
union
(
  AzureDiagnostics
  | where Category == "kube-audit"
  | where TimeGenerated > ago(24h)
  | extend AuditLog = parse_json(log_s)
  | where AuditLog.objectRef.resource == "pods"
  | where AuditLog.objectRef.namespace in (FissionNamespaces)
  | where AuditLog.verb in ("create", "patch", "update")
  | extend PodSpec = tostring(AuditLog.requestObject.spec)
  | where PodSpec has_any (SuspiciousPodSpecFields)
  | extend UserAgent = tostring(AuditLog.userAgent)
  | extend Username = tostring(AuditLog.user.username)
  | extend SourceIP = tostring(AuditLog.sourceIPs[0])
  | extend PodName = tostring(AuditLog.objectRef.name)
  | extend Namespace = tostring(AuditLog.objectRef.namespace)
  | project TimeGenerated, Username, SourceIP, PodName, Namespace, UserAgent, PodSpec
  | extend AlertReason = "Suspicious PodSpec field in Fission namespace pod creation"
),
(
  KubePodInventory
  | where TimeGenerated > ago(24h)
  | where Namespace in (FissionNamespaces)
  | extend PodLabels = parse_json(PodLabel)
  | extend PodAnnotations = tostring(parse_json("[]"))
  | join kind=inner (
      ContainerLog
      | where TimeGenerated > ago(24h)
      | where LogEntry has_any ("hostPID", "hostNetwork", "privileged: true", "escape", "nsenter", "/proc/1/root")
    ) on ContainerID
  | project TimeGenerated, PodName, Namespace, ContainerName, LogEntry
  | extend AlertReason = "Fission function container log indicates escape attempt"
)
| extend CVE = "CVE-2026-50563"
| extend Severity = "Critical"

index=kubernetes sourcetype=kube:apiserver:audit OR sourcetype=kube:container:log
| eval is_fission_ns=if(match('objectRef.namespace', "^fission"), 1, 0)
| eval is_pod_create=if(match(verb, "create|patch|update") AND 'objectRef.resource'="pods", 1, 0)
| eval has_privesc_field=if(
    match('requestObject.spec', "hostPID.*true|hostNetwork.*true|hostIPC.*true|privileged.*true|hostPath|allowPrivilegeEscalation.*true"),
    1, 0
  )
| eval is_escape_log=if(
    match(log, "nsenter|/proc/1/root|/host/|chroot.*proc|escape"),
    1, 0
  )
| where (is_fission_ns=1 AND is_pod_create=1 AND has_privesc_field=1) OR (is_fission_ns=1 AND is_escape_log=1)
| eval detection_type=case(
    is_pod_create=1 AND has_privesc_field=1, "PodSpec Injection",
    is_escape_log=1, "Container Escape Indicator",
    true(), "Unknown"
  )
| eval cve="CVE-2026-50563"
| eval severity="critical"
| table _time, host, 'user.username', 'sourceIPs{0}', 'objectRef.namespace', 'objectRef.name', detection_type, 'requestObject.spec', log, cve, severity
| sort -_time

sequence by kubernetes.pod.name with maxspan=5m
  [any where kubernetes.audit.objectRef.resource == "pods"
   and kubernetes.audit.objectRef.namespace : ("fission*")
   and kubernetes.audit.verb in ("create", "patch", "update")
   and (
     kubernetes.audit.requestObject.spec.hostPID == true
     or kubernetes.audit.requestObject.spec.hostNetwork == true
     or kubernetes.audit.requestObject.spec.hostIPC == true
     or kubernetes.audit.requestObject.spec.containers.securityContext.privileged == true
     or kubernetes.audit.requestObject.spec.volumes.hostPath.path : ("/", "/etc", "/proc", "/var/run/docker.sock")
   )
  ]
  [any where kubernetes.container.name : ("*fission*", "*function*")
   and (
     process.name in ("nsenter", "chroot", "unshare")
     or process.args : ("/proc/1/root*", "/host/*", "--target 1")
   )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS Username,
  "devicepayload" AS RawPayload,
  CATEGORYDESCRIPTION(category) AS EventCategory,
  logsourcename(logsourceid) AS LogSource
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%kubernetes%'
  AND (
    ("devicepayload" ILIKE '%"namespace":"fission%'
     AND "devicepayload" ILIKE '%"verb":"create"%'
     AND "devicepayload" ILIKE '%"resource":"pods"%'
     AND (
       "devicepayload" ILIKE '%"hostPID":true%'
       OR "devicepayload" ILIKE '%"hostNetwork":true%'
       OR "devicepayload" ILIKE '%"privileged":true%'
       OR "devicepayload" ILIKE '%"hostPath"%'
       OR "devicepayload" ILIKE '%"hostIPC":true%'
     )
    )
    OR
    ("devicepayload" ILIKE '%fission%'
     AND (
       "devicepayload" ILIKE '%nsenter%'
       OR "devicepayload" ILIKE '%/proc/1/root%'
       OR "devicepayload" ILIKE '%/host/%'
     )
    )
  )
  AND QIDNAME(qid) NOT ILIKE '%test%'
LAST 24 HOURS

_sourceCategory=kubernetes/audit OR _sourceCategory=kubernetes/containers
| json field=_raw "objectRef.namespace" as namespace nodrop
| json field=_raw "objectRef.resource" as resource nodrop
| json field=_raw "verb" as verb nodrop
| json field=_raw "user.username" as username nodrop
| json field=_raw "sourceIPs[0]" as source_ip nodrop
| json field=_raw "requestObject.spec" as pod_spec nodrop
| where namespace matches "fission*" or _raw matches "fission*"
| where (
    (resource = "pods" and verb in ("create", "patch", "update") and (
      pod_spec matches "*hostPID*true*"
      or pod_spec matches "*hostNetwork*true*"
      or pod_spec matches "*privileged*true*"
      or pod_spec matches "*hostPath*"
      or pod_spec matches "*hostIPC*true*"
    ))
    or
    (_raw matches "*nsenter*" or _raw matches "*/proc/1/root*" or _raw matches "*/host/*")
  )
| eval detection_type = if(resource = "pods" and verb in ("create","patch","update"), "PodSpec Injection", "Escape Indicator")
| eval cve = "CVE-2026-50563"
| count by _time, username, source_ip, namespace, detection_type, cve
| sort by _time desc

rule fission_podspec_injection_cve_2026_50563 {
  meta:
    author = "Detection Engineering"
    description = "Detects CVE-2026-50563 Fission PodSpec injection leading to node escape"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/fission/fission/security/advisories/GHSA-v455-mv2v-5g92"
    cve = "CVE-2026-50563"

  events:
    (
      $audit.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
      and $audit.target.namespace = /^fission/
      and $audit.target.resource.type = "pods"
      and (
        $audit.security_result.action = "ALLOW"
      )
      and (
        $audit.target.resource.attribute.labels["spec.hostPID"] = "true"
        or $audit.target.resource.attribute.labels["spec.hostNetwork"] = "true"
        or $audit.target.resource.attribute.labels["spec.hostIPC"] = "true"
        or re.regex($audit.target.resource.name, `privileged.*true|hostPath`)
      )
    )
    or
    (
      $process.metadata.event_type = "PROCESS_LAUNCH"
      and $process.target.process.file.full_path = /nsenter|unshare/
      and $process.principal.namespace = /^fission/
    )

  condition:
    $audit or $process
}

#event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "SyntheticProcessRollup2")
| NamespaceName = /^fission/i
| (
    FileName IN ["nsenter", "unshare", "chroot"]
    OR CommandLine = /\/proc\/1\/root|\/host\/|\/hostfs\//
    OR CommandLine = /--target 1|--mount.*proc|--pid.*host/
  )
| ParentBaseFileName IN ["fission-fetcher", "env", "sh", "bash", "python3", "node"]
| groupby([aid, ComputerName, NamespaceName, FileName, CommandLine, UserName, ParentBaseFileName])
| rename aid as AgentID
| eval CVE = "CVE-2026-50563"
| eval Severity = "Critical"
| eval ThreatDescription = "Fission container executor PodSpec injection - potential node escape"
| sort -@timestamp