- rule: Container Escape via Privileged Mode
desc: Detect attempts to escape container using privileged capabilities
condition: >
spawned_process and container and
(proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or
(proc.name = chroot and proc.args contains "/host"))
output: >
Container escape attempt via privileged operation
(user=%user.name container=%container.name image=%container.image.repository
command=%proc.cmdline pid=%proc.pid %container.info)
priority: CRITICAL
tags: [container, escape, T1611]
- rule: Container Access to Docker Socket
desc: Detect container reading/writing to Docker socket
condition: >
(open_read or open_write) and container and
fd.name = /var/run/docker.sock
output: >
Docker socket accessed from container
(user=%user.name container=%container.name image=%container.image.repository
fd=%fd.name command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, docker_socket]
- rule: Container Access to Sensitive Proc Paths
desc: Detect container accessing host-sensitive proc paths
condition: >
open_read and container and
(fd.name startswith /proc/sysrq-trigger or
fd.name startswith /proc/kcore or
fd.name startswith /proc/kmsg or
fd.name startswith /proc/kallsyms or
fd.name startswith /sys/kernel)
output: >
Sensitive proc/sys access from container
(user=%user.name container=%container.name path=%fd.name
command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, proc_access]
- rule: Container Cgroup Escape Attempt
desc: Detect writing to cgroup release_agent (escape technique)
condition: >
open_write and container and
(fd.name contains release_agent or
fd.name contains notify_on_release)
output: >
Cgroup escape attempt detected
(user=%user.name container=%container.name path=%fd.name
command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, cgroup]
- rule: Container Loading Kernel Module
desc: Detect container attempting to load kernel modules
condition: >
spawned_process and container and
(proc.name in (modprobe, insmod, rmmod) or
(evt.type = init_module or evt.type = finit_module))
output: >
Kernel module load attempt from container
(user=%user.name container=%container.name command=%proc.cmdline
%container.info)
priority: CRITICAL
tags: [container, escape, kernel_module]
- rule: Container Namespace Manipulation
desc: Detect setns/unshare syscalls from container
condition: >
container and (evt.type = setns or evt.type = unshare) and
not proc.name in (containerd-shim, runc)
output: >
Namespace manipulation from container
(user=%user.name container=%container.name syscall=%evt.type
command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, namespace]
- rule: Container Mount Sensitive Filesystem
desc: Detect container mounting host filesystems
condition: >
spawned_process and container and proc.name = mount and
(proc.args contains "/dev/" or proc.args contains "proc" or
proc.args contains "sysfs")
output: >
Sensitive mount operation from container
(user=%user.name container=%container.name command=%proc.cmdline
%container.info)
priority: HIGH
tags: [container, escape, mount]
{
"defaultAction": "SCMP_ACT_ERRNO",
"archMap": [
{ "architecture": "SCMP_ARCH_X86_64", "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"] }
],
"syscalls": [
{
"names": [
"read", "write", "open", "close", "stat", "fstat", "lstat",
"poll", "lseek", "mmap", "mprotect", "munmap", "brk",
"rt_sigaction", "rt_sigprocmask", "ioctl", "access",
"pipe", "select", "sched_yield", "dup", "dup2",
"nanosleep", "getpid", "socket", "connect", "accept",
"sendto", "recvfrom", "bind", "listen", "getsockname",
"getpeername", "socketpair", "setsockopt", "getsockopt",
"clone", "fork", "vfork", "execve", "exit", "wait4",
"kill", "getuid", "getgid", "geteuid", "getegid",
"epoll_create", "epoll_wait", "epoll_ctl", "epoll_create1",
"futex", "set_tid_address", "set_robust_list",
"openat", "newfstatat", "readlinkat", "fchownat",
"clock_gettime", "clock_getres", "clock_nanosleep",
"getrandom", "memfd_create", "statx", "rseq"
],
"action": "SCMP_ACT_ALLOW"
},
{
"names": ["unshare", "setns", "mount", "umount2", "pivot_root",
"init_module", "finit_module", "delete_module",
"kexec_load", "kexec_file_load", "ptrace",
"reboot", "swapon", "swapoff", "sethostname",
"setdomainname", "keyctl", "bpf"],
"action": "SCMP_ACT_LOG",
"comment": "Log escape-relevant syscalls for detection"
}
]
}
