<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-container-escape
description: >-
  Detect container escape attempts including privileged breakouts, Docker socket
  abuse, cgroup escapes, kernel exploitation, and namespace manipulation using
  Falco rules, eBPF tracing, and audit log analysis.
domain: cybersecurity
subdomain: container-security
tags:
  - container-escape
  - falco
  - ebpf
  - tetragon
  - runtime-detection
  - privilege-escalation
  - namespace-abuse
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1611"]
---

# Detecting Container Escape

## Overview

Container escapes allow attackers to break out of container isolation and access
the host system. This skill covers detection of common escape vectors — privileged
container abuse, Docker socket mounting, cgroup release_agent exploitation,
kernel vulnerability exploitation, and namespace manipulation — using Falco rules,
Cilium Tetragon eBPF policies, and Kubernetes audit log correlation.

Mode: `[MODE: BLUE]` with `[MODE: PURPLE]` — Detection engineering for escape vectors.

## Prerequisites

| Requirement | Details |
|---|---|
| Falco >= 0.37 or Cilium Tetragon deployed on cluster nodes | Required |
| Kubernetes audit logging enabled | Required |
| Linux kernel >= 5.8 for eBPF-based detection | Required |
| Access to container runtime logs (containerd/CRI-O) | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/detecting-container-escape-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/detecting-container-escape-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/detecting-container-escape-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Container Escape Detection
id: d4ed96a9-5ff9-4cd6-855d-3fe02790fac1
status: experimental
description: Detects suspicious activity related to detecting container escape techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1611
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Container Escape Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1611 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [MITRE ATT&CK T1611 — Escape to Host](https://attack.mitre.org/techniques/T1611/)
- [Falco Rules Reference](https://falco.org/docs/reference/rules/)
- [Cilium Tetragon](https://tetragon.io/docs/)
