AWS EKS: Deployment of containers with excessive Linux capabilities

This brief outlines a detection capability for monitoring AWS EKS control-plane audit logs for the creation of pods with dangerously permissive Linux capabilities. Added capabilities - such as CAP_SYS_ADMIN, CAP_NET_ADMIN, or CAP_BPF - grant threads privileged access that can be abused to bypass security boundaries, modify kernel-level processes, or perform container breakouts. This detection is intended for identifying unauthorized or anomalous container deployments that deviate from the principle of least privilege.

Impact

Containers with excessive capabilities can be leveraged to escape to the host machine, intercept network traffic within the cluster, perform unauthorized system administration tasks, or load malicious kernel modules.

Recommendation

• Enable EKS control-plane audit logs and stream them to your security information and event management (SIEM) system using the AWS integration.
• Audit existing workloads to identify containers running with added capabilities and verify their business necessity.
• Implement Pod Security Admission (PSA) policies to restrict the use of dangerous capabilities in non-infrastructure namespaces.
• Review the identity (IAM principal) associated with pod creation to ensure RBAC is scoped appropriately for users or CI/CD pipelines.