performing-container-escape-detection

name	performing-container-escape-detection
description	Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.
domain	cybersecurity
tags	["performing","container","escape","detection"]
subdomain	container-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Performing Container Escape Detection

Overview

Cybersecurity skill for performing container escape detection. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing container escape detection"

• "When conducting security assessments that involve performing container escape de"

• "When following incident response procedures for related security events"

• "When performing scheduled security testing or auditing activities"

• When conducting security assessments that involve performing container escape detection

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Familiarity with container security concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Plan Operations — Define objectives, scope, and success criteria for container escape detection operations.