detecting-container-escape-attempts

name	detecting-container-escape-attempts
description	Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
domain	cybersecurity
subdomain	container-security
tags	["containers","kubernetes","docker","security","runtime-security","escape-detection"]
version	1.0
author	mahipal
license	Apache-2.0

Detecting Container Escape Attempts

Overview

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Prerequisites

• Linux host with kernel 5.10+ (eBPF support)
• Falco 0.37+ installed (kernel module or eBPF probe)
• Docker Engine or containerd runtime
• auditd configured
• Root access for eBPF/kernel module loading

Core Concepts

Common Container Escape Vectors

Vector	Technique	MITRE ID
Privileged containers	Mount host filesystem, load kernel modules	T1611
Docker socket mount	Create privileged container from within	T1610
Kernel exploits	CVE-2022-0185 (fsconfig), Dirty Pipe, runc CVEs	T1068
Capability abuse	CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN	T1548
Sensitive mounts	/proc/sysrq-trigger, /proc/kcore, cgroup release_agent	T1611
Namespace escape	nsenter, unshare to host namespaces	T1611
Symlink/bind mount	Escape through /proc/self/root	T1611

Detection Layers

1. Syscall monitoring - eBPF/kernel module captures syscalls in real-time
2. File integrity - Detect modification of escape-enabling paths
3. Process monitoring - Track process creation, namespace changes
4. Network monitoring - Detect container-to-host connections
5. Audit logging - Linux auditd for capability and mount operations

Implementation Steps

Step 1: Deploy Falco for Runtime Detection

# falco-values.yaml for Helm deployment
falco:
  driver:
    kind: ebpf   # or modern_ebpf for kernel 5.8+
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/rules.d
  json_output: true
  json_include_output_property: true
  http_output:
    enabled: true
    url: "http://falcosidekick:2801"
  grpc:
    enabled: true
  priority: warning

# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco-system --create-namespace \
  -f falco-values.yaml

Step 2: Custom Falco Rules for Escape Detection

# /etc/falco/rules.d/container_escape.yaml

# Detect container escape via privileged container
- rule: Container Escape via Privileged Mode
  desc: Detect attempts to escape container using privileged capabilities
  condition: >
    spawned_process and container and
    (proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or
     (proc.name = chroot and proc.args contains "/host"))
  output: >
    Container escape attempt via privileged operation
    (user=%user.name container=%container.name image=%container.image.repository
     command=%proc.cmdline pid=%proc.pid %container.info)
  priority: CRITICAL
  tags: [container, escape, T1611]

# Detect Docker socket access from container
- rule: Container Access to Docker Socket
  desc: Detect container reading/writing to Docker socket
  condition: >
    (open_read or open_write) and container and
    fd.name = /var/run/docker.sock
  output: >
    Docker socket accessed from container
    (user=%user.name container=%container.name image=%container.image.repository
     fd=%fd.name command=%proc.cmdline %container.info)
   
   [, , ]


       
        
         
   [, , ]


     
         
         
   [, , ]


     
         
         
   [, , ]


    
       
         
   [, , ]


     
       
         
   [, , ]

Step 3: Configure Seccomp Profile for Escape Prevention

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "archMap": [
    { "architecture": "SCMP_ARCH_X86_64", "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"] }
  ],
  "syscalls": [
    {
      "names": [
        "read", "write", "open", "close", "stat", "fstat", "lstat",
        "poll", "lseek", "mmap", "mprotect", "munmap", "brk",
        "rt_sigaction",   
            
            
            
           
             
            
           
          
           
          
           
      
       
    
    
           
                  
                  
                   
                  
       
       
    
  

Step 4: Audit Rules for Container Escape

# /etc/audit/rules.d/container-escape.rules

# Monitor namespace operations
-a always,exit -F arch=b64 -S setns -S unshare -k container_escape
-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount
-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_module
-a always,exit -F arch=b64 -S ptrace -k process_trace

# Monitor sensitive paths
-w /var/run/docker.sock -p rwxa -k docker_socket
-w /proc/sysrq-trigger -p w -k sysrq
-w /proc/kcore -p r -k kcore_read

# Monitor container runtime
-w /usr/bin/runc -p x -k container_runtime
-w /usr/bin/containerd -p x -k container_runtime
-w /usr/bin/docker -p x -k container_runtime

Step 5: Real-Time Alert Pipeline

# Falcosidekick configuration for alert routing
config:
  slack:
    webhookurl: "https://hooks.slack.com/services/xxx"
    minimumpriority: "critical"
    messageformat: |
      *Container Escape Alert*
      Rule: {{ .Rule }}
      Priority: {{ .Priority }}
      Output: {{ .Output }}

  elasticsearch:
    hostport: "https://elasticsearch:9200"
    index: "falco-alerts"
    minimumpriority: "warning"

  pagerduty:
    routingkey: "xxxx"
    minimumpriority: "critical"

Validation Commands

# Test Falco rules with event generator
kubectl run falco-event-generator \
  --image=falcosecurity/event-generator \
  --restart=Never \
  -- run syscall --action PtraceAttachContainer

# Check Falco alerts
kubectl logs -n falco-system -l app.kubernetes.io/name=falco --tail=50

# Verify seccomp profile is loaded
docker inspect --format '{{.HostConfig.SecurityOpt}}' <container-id>

# Check audit logs for escape-related events
ausearch -k container_escape --interpret

References

• Falco Runtime Security
• Container Escape Techniques - HackTricks
• MITRE ATT&CK T1611 - Escape to Host
• Sysdig Container Security