Privileged Container Device Access

Description

Detects container processes accessing raw block devices, which could be used to escape container isolation by directly reading or writing to host storage. This technique allows attackers to access the host filesystem, modify system files, or extract sensitive data even without traditional container escape. Requires the container to have privileged access or specific device permissions. Override user_known_privileged_device_access for legitimate storage operations.

Query · falco

(open_read or open_write) and container and (fd.name startswith /dev/sd or
     fd.name startswith /dev/nvme or
     fd.name startswith /dev/vd or
     fd.name startswith /dev/xvd or
     fd.name = /dev/mem or
     fd.name = /dev/kmem)
and not user_known_privileged_device_access

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_privileged_device_access
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Container accessing block device | device=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Privileged Container Device Access · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Privileged Container Device Access
desc: 'Detects container processes accessing raw block devices, which could be used
  to escape container isolation by directly reading or writing to host storage. This
  technique allows attackers to access the host filesystem, modify system files, or
  extract sensitive data even without traditional container escape. Requires the container
  to have privileged access or specific device permissions. Override user_known_privileged_device_access
  for legitimate storage operations.

  '
condition: "(open_read or open_write) and container and (fd.name startswith /dev/sd\
  \ or\n     fd.name startswith /dev/nvme or\n     fd.name startswith /dev/vd or\n\
  \     fd.name startswith /dev/xvd or\n     fd.name = /dev/mem or\n     fd.name =\
  \ /dev/kmem)\nand not user_known_privileged_device_access\n"
output: Container accessing block device | device=%fd.name evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: CRITICAL
tags:
- maturity_sandbox
- container
- filesystem
- mitre_privilege_escalation
- T1611

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.