Mount Launched in Privileged Container

Description

Detect filesystem mounts (using the mount binary) within a privileged container. Due to the elevated privileges, this action could be one of the TTPs used in an attempt to escape from a container to the host. This type of action is often preceded by reconnaissance activities, for which you can also create custom rules.

Query · falco

spawned_process and container and container.privileged=true and proc.name=mount and not mount_info and not known_gke_mount_in_privileged_containers and not known_aks_mount_in_privileged_containers and not known_eks_mount_in_privileged_containers and not user_known_mount_in_privileged_containers

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro known_aks_mount_in_privileged_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro known_eks_mount_in_privileged_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro known_gke_mount_in_privileged_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro mount_info
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_mount_in_privileged_containers
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Mount was executed inside a privileged container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Mount Launched in Privileged Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Mount Launched in Privileged Container
desc: 'Detect filesystem mounts (using the mount binary) within a privileged container.
  Due to the elevated privileges, this action could be one of the TTPs used in an
  attempt to escape from a container to the host. This type of action is often preceded
  by reconnaissance activities, for which you can also create custom rules.

  '
condition: 'spawned_process and container and container.privileged=true and proc.name=mount
  and not mount_info and not known_gke_mount_in_privileged_containers and not known_aks_mount_in_privileged_containers
  and not known_eks_mount_in_privileged_containers and not user_known_mount_in_privileged_containers

  '
output: Mount was executed inside a privileged container | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_incubating
- container
- cis
- filesystem
- mitre_privilege_escalation
- T1611

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.