Change namespace privileges via unshare

rule: Change namespace privileges via unshare
desc: 'Unprivileged users in containers may not have CAP_SYS_ADMIN or other elevated
  privileges. However, they can use the unshare system call with CLONE_NEWNS or CLONE_NEWUSER
  to create or clone a namespace or user with the necessary privileges to conduct
  further attacks. It is best practice to block the unshare system call via seccomp
  if it is not needed. Misuse of unshare can be related to misconfigured Kubernetes
  clusters, for example.

  '
condition: 'evt.type=unshare and container and not thread.cap_permitted contains CAP_SYS_ADMIN

  '
output: Change namespace privileges via unshare | res=%evt.res evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- container
- mitre_privilege_escalation
- T1611