Cross-source coverage
T1611 / ATT&CK
Escape to Host
From MITRE ATT&CK 19.2
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.
There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as unshare and keyctl to escalate privileges and steal secrets.
Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as docker.sock, to break out of the container via a Container Administration Command. Adversaries may also escape via Exploitation for Privilege Escalation, such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.
In ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.
Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.
- Tactics
- Privilege Escalation
- Platforms
- Windows · Linux · Containers · ESXi
- Telemetry
-
docker:daemonkubernetes:apiserverauditd:SYSCALLlinux:SysmonWinEventLog:SecurityWinEventLog:Sysmonesxi:vmkernel
How MITRE says to detect it DET0219
Detection Strategy for Escape to Host
Containers Analytic 0612
Detection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.
docker:daemoncontainer create/start with privileged flag or host volume mountkubernetes:apiserverPod spec with hostPath or privileged securityContext
Linux Analytic 0613
Detection of Linux container escape attempts via syscalls (`unshare`, `keyctl`, `mount`) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.
auditd:SYSCALLunshare, mount, keyctl, setns syscalls executed by containerized processeslinux:Sysmonprocess creation events linked to container namespaces executing host-level binaries
Windows Analytic 0614
Detection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=11
ESXi Analytic 0615
Detection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.
esxi:vmkernelVM exit/entry anomalies, unexpected hypercalls, or kernel module loading
elastic/detection-rules
43 rules| Detection | Severity | Format |
|---|---|---|
| Chroot Execution in Container Context on Linux | High | Elastic TOML |
| Nsenter Execution with Target Flag Inside Container | High | Elastic TOML |
| Nsenter to PID Namespace via Auditd | High | Elastic TOML |
| Potential Chroot Container Escape via Mount | High | Elastic TOML |
| Potential Privilege Escalation in Container via Runc Init | High | Elastic TOML |
| Potential Privilege Escalation via Container Misconfiguration | High | Elastic TOML |
| Privileged Container Creation with Host Directory Mount | High | Elastic TOML |
| Container Runtime CLI Execution with Suspicious Arguments | Medium | Elastic TOML |
| DebugFS Execution Detected via Defend for Containers | Medium | Elastic TOML |
| Egress Connection from Entrypoint in Container | Medium | Elastic TOML |
+ 33 more from elastic/detection-rules → showing the 10 highest-severity
panther-labs/panther-analysis
10 rules| Detection | Severity | Format |
|---|---|---|
| GCP K8S Pod Create Or Modify Host Path Volume Mount | High | Panther Python |
| Kubernetes Pod with Dangerous Linux Capabilities | High | Panther Python |
| GCP K8s Pod Attached To Node Host Network | Medium | Panther Python |
| GCP K8s Pod Using Host PID Namespace | Medium | Panther Python |
| Kubernetes Pod Attached To Host Network | Medium | Panther Python |
| Kubernetes Pod Created in System Namespace | Medium | Panther Python |
| Kubernetes Pod Using Host IPC Namespace | Medium | Panther Python |
| Kubernetes Pod Using Host PID Namespace | Medium | Panther Python |
| Kubernetes Pod With HostPath Volume Mount | Medium | Panther Python |
| Upwind Runtime Detection Passthrough | Medium | Panther Python |
falcosecurity/rules
8 rules| Detection | Severity | Format |
|---|---|---|
| Detect release_agent File Container Escapes | Critical | Falco YAML |
| Privileged Container Device Access | Critical | Falco YAML |
| Container Access to Host Sensitive Paths | Medium | Falco YAML |
| Debugfs Launched in Privileged Container | Medium | Falco YAML |
| Modify Container Entrypoint | Medium | Falco YAML |
| Mount Launched in Privileged Container | Medium | Falco YAML |
| Change namespace privileges via unshare | Low | Falco YAML |
| Change thread namespace | Low | Falco YAML |
chainguard-dev/osquery-defense-kit
3 rules · 2 families| Detection | Severity | Format |
|---|---|---|
| Detect the execution of a Docker containing mounting the root filesystem 2 variants | Undefined | osquery SQL |
| Detect the execution of a Docker containing mounting the root filesystem 2 variants | Undefined | osquery SQL |
| Detect the execution of privileged Docker containers which can be used to escape to the host. | Undefined | osquery SQL |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Cisco IOS XE Guestshell Activation and Destroy | Undefined | SPL |
| Cisco Isovalent - Potential Escape to Host | Undefined | SPL |
| Linux Docker Root Directory Mount | Undefined | SPL |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Container With A hostPath Mount Created | Low | Sigma |
| Privileged Container Deployed | Low | Sigma |
elastic/protections-artifacts
2 rules| Detection | Severity | Format |
|---|---|---|
| Potential Cgroup Privilege Escalation/Container Escape via Mount | Undefined | Elastic TOML |
| Suspicious Privileged Docker Execution | Undefined | Elastic TOML |