Detect release_agent File Container Escapes

Description

Detect an attempt to exploit a container escape using release_agent file. By running a container with certains capabilities, a privileged user can modify release_agent file and escape from the container.

Query · falco

open_write and container and fd.name endswith release_agent and (user.uid=0 or thread.cap_effective contains CAP_DAC_OVERRIDE) and thread.cap_effective contains CAP_SYS_ADMIN

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Detect an attempt to exploit a container escape using release_agent file | file=%fd.name cap_effective=%thread.cap_effective evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Detect release_agent File Container Escapes · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Detect release_agent File Container Escapes
desc: 'Detect an attempt to exploit a container escape using release_agent file. By
  running a container with certains capabilities, a privileged user can modify release_agent
  file and escape from the container.

  '
condition: 'open_write and container and fd.name endswith release_agent and (user.uid=0
  or thread.cap_effective contains CAP_DAC_OVERRIDE) and thread.cap_effective contains
  CAP_SYS_ADMIN

  '
output: Detect an attempt to exploit a container escape using release_agent file |
  file=%fd.name cap_effective=%thread.cap_effective evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: CRITICAL
tags:
- maturity_stable
- container
- process
- mitre_privilege_escalation
- T1611

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.