Anthropic-Cybersecurity-Skills/skills/detecting-privilege-escalation-in-kubernetes-pods/references/standards.md

Standards - Detecting Privilege Escalation in Kubernetes Pods

MITRE ATT&CK for Containers

Technique	ID	Description
Escape to Host	T1611	Container breakout via privilege escalation
Exploitation for Privilege Escalation	T1068	Kernel exploit from container
Abuse Elevation Control	T1548	Setuid/setgid binary exploitation
Valid Accounts	T1078	Service account token theft
Create Account	T1136	Modify /etc/passwd in container

CIS Kubernetes Benchmark v1.8

• 5.2.1-5.2.9: Pod Security Standards
• 5.7.3: Apply security context to pods

NIST SP 800-190

• Section 4.3: Container runtime vulnerabilities
• Section 5.4: Runtime monitoring for privilege escalation

Pod Security Standards

Profile	Level	Key Restrictions
Privileged	Unrestricted	No restrictions
Baseline	Minimally restrictive	No privileged, no hostPID/hostNetwork
Restricted	Heavily restricted	Non-root, drop all caps, no privilege escalation