Escape to Host T1611
Tactic: Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.
Events covered
5 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceProcessEvents | any | Process activity (any) |
| Defender-DeviceProcessEvents | ProcessCreated | Process created |
| ESF | exec | Process Execution (Notify) |
Authoring guide
Patterns shared across the 51 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (64 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (282 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (231 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 2 rules
Elastic 34 rules
- Chroot Execution Detected via Defend for Containers
- Chroot Execution in Container Context on Linux
- Container Runtime CLI Execution with Suspicious Arguments
- DebugFS Execution Detected via Defend for Containers
- Docker Release File Creation
- Egress Connection from Entrypoint in Container
- File System Debugger Launched Inside a Container
- Kernel Load or Unload via Kexec Detected
- Kubernetes API Server Proxying Request to Kubelet
- Kubernetes Container Created with Excessive Linux Capabilities
- Kubernetes Ephemeral Container Added to Pod
- Kubernetes Pod Created with a Sensitive hostPath Volume
- Kubernetes Pod Created With HostIPC
- Kubernetes Pod Created With HostNetwork
- Kubernetes Pod Created With HostPID
- Kubernetes Privileged Pod Created
- Mount Execution Detected via Defend for Containers
- Mount Launched Inside a Container
- Namespace Manipulation Using Unshare
- Namespace Manipulation Using Unshare in a Container
- Nsenter Execution with Target Flag Inside Container
- Nsenter to PID Namespace via Auditd
- Pod or Container Creation with Suspicious Command-Line
- Potential Chroot Container Escape via Mount
- Potential Docker Escape via Nsenter
- Potential notify_on_release Container Escape Detected via Defend for Containers
- Potential Privilege Escalation in Container via Runc Init
- Potential Privilege Escalation through Writable Docker Socket
- Potential Privilege Escalation via Container Misconfiguration
- Potential release_agent Container Escape Detected via Defend for Containers
- Privileged Container Creation with Host Directory Mount
- Privileged Docker Container Creation
- Suspicious Container Runtime CLI Execution
- Unusual Process Connection to Docker or Containerd Socket
Splunk 3 rules
- Cisco IOS XE Guestshell Activation and Destroy
- Cisco Isovalent - Potential Escape to Host
- Linux Docker Root Directory Mount
Kusto 2 rules
Panther 10 rules
- GCP K8s Pod Attached To Node Host Network
- GCP K8S Pod Create Or Modify Host Path Volume Mount
- GCP K8s Pod Using Host PID Namespace
- Kubernetes Pod Attached To Host Network
- Kubernetes Pod Created in System Namespace
- Kubernetes Pod Using Host IPC Namespace
- Kubernetes Pod Using Host PID Namespace
- Kubernetes Pod with Dangerous Linux Capabilities
- Kubernetes Pod With HostPath Volume Mount
- Upwind Runtime Detection Passthrough