detecting-container-escape-attempts

name	detecting-container-escape-attempts
description	Detect container escape attempts where an adversary breaks out of container isolation to reach the host or other containers, by monitoring namespace manipulation, capability abuse, kernel exploits, sensitive mounted paths, and anomalous syscalls with tools like Falco, Sysdig, and seccomp/audit rules. Use when hunting for privilege escalation from containerized workloads or investigating suspected breakout from a Docker/Kubernetes environment.
domain	cybersecurity
subdomain	container-security
tags	["containers","kubernetes","docker","security","runtime-security","escape-detection"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"]
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
mitre_attack	["T1610","T1611","T1609","T1525"]

Detecting Container Escape Attempts

Overview

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

When to Use

• When investigating security incidents that require detecting container escape attempts
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Linux host with kernel 5.10+ (eBPF support)
• Falco 0.37+ installed (kernel module or eBPF probe)
• Docker Engine or containerd runtime
• auditd configured
• Root access for eBPF/kernel module loading

Core Concepts

Common Container Escape Vectors

Vector	Technique	MITRE ID
Privileged containers	Mount host filesystem, load kernel modules	T1611
Docker socket mount	Create privileged container from within	T1610
Kernel exploits	CVE-2022-0185 (fsconfig), Dirty Pipe, runc CVEs	T1068
Capability abuse	CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN	T1548
Sensitive mounts	/proc/sysrq-trigger, /proc/kcore, cgroup release_agent	T1611
Namespace escape	nsenter, unshare to host namespaces	T1611
Symlink/bind mount	Escape through /proc/self/root	T1611

Detection Layers

1. Syscall monitoring - eBPF/kernel module captures syscalls in real-time
2. File integrity - Detect modification of escape-enabling paths
3. Process monitoring - Track process creation, namespace changes
4. Network monitoring - Detect container-to-host connections
5. Audit logging - Linux auditd for capability and mount operations