detecting-container-escape-attempts

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators. Use when working with detecting container escape attempts.

الانتقال إلى التثبيت

المستودع: oyi77/1ai-skills
آخر نشاط في المصدر: ٣١ يوليو ٢٠٢٦ في ١٥:٢٢
لغة SKILL.md المكتشفة: الإنجليزية
النجوم: ٨
التفرعات: ٠

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

العودة إلى البحث العودة إلى التثبيت

name	detecting-container-escape-attempts
description	Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators. Use when working with detecting container escape attempts.
domain	cybersecurity
subdomain	container-security
tags	["containers","kubernetes","docker","security","runtime-security","escape-detection"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"]
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Detecting Container Escape Attempts

Overview

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

When to Use

Trigger phrases:

"detecting container escape attempts"
"When investigating security incidents that require detecting container escape at"
"When building detection rules or threat hunting queries for this domain"
"When SOC analysts need structured procedures for this analysis type"
When investigating security incidents that require detecting container escape attempts
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Linux host with kernel 5.10+ (eBPF support)
Falco 0.37+ installed (kernel module or eBPF probe)
Docker Engine or containerd runtime
auditd configured
Root access for eBPF/kernel module loading

Core Concepts

This section covers core concepts for detecting container escape attempts.

Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase

Common Container Escape Vectors

Vector	Technique	MITRE ID
Privileged containers	Mount host filesystem, load kernel modules	T1611
Docker socket mount	Create privileged container from within	T1610
Kernel exploits	CVE-2022-0185 (fsconfig), Dirty Pipe, runc CVEs	T1068
Capability abuse	CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN	T1548
Sensitive mounts	/proc/sysrq-trigger, /proc/kcore, cgroup release_agent

# falco-values.yaml for Helm deployment
falco:
  driver:
    kind: ebpf   # or modern_ebpf for kernel 5.8+
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/rules.d
  json_output: true
  json_include_output_property: true
  http_output:
    enabled: true
    url: "http://falcosidekick:2801"
  grpc:
    enabled: true
  priority: warning

# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco-system --create-namespace \
  -f falco-values.yaml

# /etc/falco/rules.d/container_escape.yaml

# Detect container escape via privileged container
- rule: Container Escape via Privileged Mode
  desc: Detect attempts to escape container using privileged capabilities
  condition: >
    spawned_process and container and
    (proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or
     (proc.name = chroot and proc.args contains "/host"))
  output: >
    Container escape attempt via privileged operation
    (user=%user.name container=%container.name image=%container.image.repository
     command=%proc.cmdline pid=%proc.pid %container.info)
  priority: CRITICAL
  tags: [container, escape, T1611]

# Detect Docker socket access from container
- rule: Container Access to Docker Socket
  desc: Detect container reading/writing to Docker socket
  condition: >
    (open_read or open_write) and container and
    fd.name = /var/run/docker.sock
  output: >
    Docker socket accessed from container
    (user=%user.name container=%container.name image=%container.image.repository
     fd=%fd.name command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, docker_socket]

# Detect sensitive proc filesystem access
- rule: Container Access to Sensitive Proc Paths
  desc: Detect container accessing host-sensitive proc paths
  condition: >
    open_read and container and
    (fd.name startswith /proc/sysrq-trigger or
     fd.name startswith /proc/kcore or
     fd.name startswith /proc/kmsg or
     fd.name startswith /proc/kallsyms or
     fd.name startswith /sys/kernel)
  output: >
    Sensitive proc/sys access from container
    (user=%user.name container=%container.name path=%fd.name
     command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, proc_access]

# Detect cgroup escape technique
- rule: Container Cgroup Escape Attempt
  desc: Detect writing to cgroup release_agent (escape technique)
  condition: >
    open_write and container and
    (fd.name contains release_agent or
     fd.name contains notify_on_release)
  output: >
    Cgroup escape attempt detected
    (user=%user.name container=%container.name path=%fd.name
     command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, cgroup]

# Detect kernel module loading from container
- rule: Container Loading Kernel Module
  desc: Detect container attempting to load kernel modules
  condition: >
    spawned_process and container and
    (proc.name in (modprobe, insmod, rmmod) or
     (evt.type = init_module or evt.type = finit_module))
  output: >
    Kernel module load attempt from container
    (user=%user.name container=%container.name command=%proc.cmdline
     %container.info)
  priority: CRITICAL
  tags: [container, escape, kernel_module]

# Detect namespace manipulation
- rule: Container Namespace Manipulation
  desc: Detect setns/unshare syscalls from container
  condition: >
    container and (evt.type = setns or evt.type = unshare) and
    not proc.name in (containerd-shim, runc)
  output: >
    Namespace manipulation from container
    (user=%user.name container=%container.name syscall=%evt.type
     command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, namespace]

# Detect mount operations from container
- rule: Container Mount Sensitive Filesystem
  desc: Detect container mounting host filesystems
  condition: >
    spawned_process and container and proc.name = mount and
    (proc.args contains "/dev/" or proc.args contains "proc" or
     proc.args contains "sysfs")
  output: >
    Sensitive mount operation from container
    (user=%user.name container=%container.name command=%proc.cmdline
     %container.info)
  priority: HIGH
  tags: [container, escape, mount]

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "archMap": [
    { "architecture": "SCMP_ARCH_X86_64", "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"] }
  ],
  "syscalls": [
    {
      "names": [
        "read", "write", "open", "close", "stat", "fstat", "lstat",
        "poll", "lseek", "mmap", "mprotect", "munmap", "brk",
        "rt_sigaction", "rt_sigprocmask", "ioctl", "access",
        "pipe", "select", "sched_yield", "dup", "dup2",
        "nanosleep", "getpid", "socket", "connect", "accept",
        "sendto", "recvfrom", "bind", "listen", "getsockname",
        "getpeername", "socketpair", "setsockopt", "getsockopt",
        "clone", "fork", "vfork", "execve", "exit", "wait4",
        "kill", "getuid", "getgid", "geteuid", "getegid",
        "epoll_create", "epoll_wait", "epoll_ctl", "epoll_create1",
        "futex", "set_tid_address", "set_robust_list",
        "openat", "newfstatat", "readlinkat", "fchownat",
        "clock_gettime", "clock_getres", "clock_nanosleep",
        "getrandom", "memfd_create", "statx", "rseq"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": ["unshare", "setns", "mount", "umount2", "pivot_root",
                "init_module", "finit_module", "delete_module",
                "kexec_load", "kexec_file_load", "ptrace",
                "reboot", "swapon", "swapoff", "sethostname",
                "setdomainname", "keyctl", "bpf"],
      "action": "SCMP_ACT_LOG",
      "comment": "Log escape-relevant syscalls for detection"
    }
  ]
}

# /etc/audit/rules.d/container-escape.rules

# Monitor namespace operations
-a always,exit -F arch=b64 -S setns -S unshare -k container_escape
-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount
-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_module
-a always,exit -F arch=b64 -S ptrace -k process_trace

# Monitor sensitive paths
-w /var/run/docker.sock -p rwxa -k docker_socket
-w /proc/sysrq-trigger -p w -k sysrq
-w /proc/kcore -p r -k kcore_read

# Monitor container runtime
-w /usr/bin/runc -p x -k container_runtime
-w /usr/bin/containerd -p x -k container_runtime
-w /usr/bin/docker -p x -k container_runtime

# Falcosidekick configuration for alert routing
config:
  slack:
    webhookurl: "https://hooks.slack.com/services/xxx"
    minimumpriority: "critical"
    messageformat: |
      *Container Escape Alert*
      Rule: {{ .Rule }}
      Priority: {{ .Priority }}
      Output: {{ .Output }}

  elasticsearch:
    hostport: "https://elasticsearch:9200"
    index: "falco-alerts"
    minimumpriority: "warning"

  pagerduty:
    routingkey: "xxxx"
    minimumpriority: "critical"

# Test Falco rules with event generator
kubectl run falco-event-generator \
  --image=falcosecurity/event-generator \
  --restart=Never \
  -- run syscall --action PtraceAttachContainer

# Check Falco alerts
kubectl logs -n falco-system -l app.kubernetes.io/name=falco --tail=50

# Verify seccomp profile is loaded
docker inspect --format '{{.HostConfig.SecurityOpt}}' <container-id>

# Check audit logs for escape-related events
ausearch -k container_escape --interpret

Rationalization	Reality
"We are too small to be targeted"	Automated attacks target everyone. Size does not matter.
"Security slows us down"	A breach slows you down 100x more. Build security in from the start.
"We will fix it after launch"	Vulnerabilities in production are exploited within hours. Fix before deploy.