Container Access to Host Sensitive Paths

Description

Detects container processes accessing paths that typically only exist when the host filesystem is mounted into the container (like /host, /rootfs, /hostfs). This may indicate a container escape attempt or a misconfigured volume mount that exposes the host filesystem. Legitimate monitoring or backup containers may access these paths, so tune accordingly using the user_known_host_path_access macro.

Query · falco

(open_read or open_write) and container and (fd.name startswith /host/ or
     fd.name startswith /rootfs/ or
     fd.name startswith /hostfs/)
and not known_container_runtime_host_access and not user_known_host_path_access

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro known_container_runtime_host_access
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_host_path_access
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Container accessing host filesystem paths | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Container Access to Host Sensitive Paths · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Container Access to Host Sensitive Paths
desc: 'Detects container processes accessing paths that typically only exist when
  the host filesystem is mounted into the container (like /host, /rootfs, /hostfs).
  This may indicate a container escape attempt or a misconfigured volume mount that
  exposes the host filesystem. Legitimate monitoring or backup containers may access
  these paths, so tune accordingly using the user_known_host_path_access macro.

  '
condition: "(open_read or open_write) and container and (fd.name startswith /host/\
  \ or\n     fd.name startswith /rootfs/ or\n     fd.name startswith /hostfs/)\nand\
  \ not known_container_runtime_host_access and not user_known_host_path_access\n"
output: Container accessing host filesystem paths | file=%fd.name evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_sandbox
- container
- filesystem
- mitre_privilege_escalation
- T1611

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.