Suspicious Privileged Docker Execution

[rule]
description = """
This rule detects the execution of a docker command in a privileged context to mount the root file system and
potentially tamper with the host file system. This may indicate an attempt to escape the container.
"""
id = "7b13c79b-e6ec-4a91-b6cd-bc9c264db0c3"
license = "Elastic License v2"
name = "Suspicious Privileged Docker Execution"
os_list = ["linux", "macos"]
reference = ["https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "docker" and
process.args == "--privileged" and process.args == "run" and process.args == "-v" and
process.args : "/:/*" and
not (
  process.args like ("docker.elastic.co/beats/elastic-agent*", "/usr/bin/ceph-osd") or
  (process.args == "prepare" and process.args in ("/:/hostfs", "/:/hostfs/")) or
  (process.args == "aktosecurity/mirror-api-logging:k8s_ebpf" and process.args == "akto-api-security-traffic-collector") or
  (process.args == "--name=c3-progenitor" and process.args == "localhost/c3:latest") or
  (process.args == "/usr/sbin/ceph-volume" and process.args == "--group-add=disk" and process.args == "--stop-signal=SIGTERM") or
  (process.args like "eu.gcr.io/revolut-labs/cardfinder*" and process.parent.args == "/srv/cardfinder/cardfinder.sh") or
  process.parent.args == "/usr/local/pf/sbin/netdata-docker-wrapper"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"