<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-container-escape-attempts
description: >-
  Detect and alert on container escape attempts including namespace breakout,
  kernel exploitation, mount abuse, and capabilities exploitation using Falco,
  auditd, and eBPF-based monitoring.
domain: cybersecurity
subdomain: container-security
tags:
  - container-escape
  - falco
  - ebpf
  - runtime-detection
  - breakout
  - kernel-exploit
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1611"]
---

# Detecting Container Escape Attempts

## Overview

Container escapes allow attackers to break out of the container boundary and
access the underlying host. This skill covers detection of escape vectors
including nsenter abuse, cgroup notify_on_release exploitation, host filesystem
mounts, and kernel vulnerability exploitation using Falco rules, Tetragon eBPF
policies, and auditd monitoring.

Mode: `[MODE: BLUE]` — Defensive runtime detection.

## Prerequisites

- Falco >= 0.37 with kernel module or eBPF probe
- auditd configured on host nodes
- Kubernetes >= 1.25
- Tetragon or Tracee for eBPF-based detection
- Access to node-level logs and /proc filesystem

## Key Concepts

### Common Container Escape Vectors

| Vector | Technique | MITRE ATT&CK |
|--------|-----------|---------------|
| Privileged container | Mount host filesystem | T1611 |
| Docker socket mount | Create privileged container | T1610 |
| Kernel exploit | CVE-2022-0185, CVE-2024-1086 | T1068 |
| nsenter abuse | Enter host namespaces | T1611 |
| cgroup escape | Notify_on_release abuse | T1611 |
| procfs mount | Access host /proc | T1003 |

### Falco Rules for Escape Detection

```yaml
- rule: Container Escape via nsenter
  desc: Detects nsenter execution inside a container targeting host namespaces
  condition: >
    spawned_process and container and proc.name = nsenter
    and proc.args contains "/proc/1/ns"
  output: >
    Container escape attempt via nsenter
    (user=%user.name container=%container.name command=%proc.cmdline
     image=%container.image.repository)
  priority: CRITICAL
  tags: [container, escape, mitre_privilege_escalation, T1611]

- rule: Mount of Sensitive Host Path
  desc: Detects mount of host-sensitive paths inside container
  condition: >
    spawned_process and container
    and (proc.name = mount or proc.name = umount)
    and (proc.args contains "/etc/shadow"
         or proc.args contains "/etc/passwd"
         or proc.args contains "/var/run/docker.sock")
  output: >
    Sensitive host path mount in container
    (user=%user.name command=%proc.cmdline container=%container.name)
  priority: CRITICAL
  tags: [container, escape, mitre_privilege_escalation]

- rule: Cgroup Escape Attempt
  desc: Detects cgroup notify_on_release abuse for container escape
  condition: >
    open_write and container
    and fd.name contains "notify_on_release"
  output: >
    Cgroup escape attempt detected
    (user=%user.name file=%fd.name container=%container.name)
  priority: CRITICAL
  tags: [container, escape, T1611]
```

### eBPF Detection with Tetragon

```yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-container-escape
spec:
  kprobes:
    - call: __x64_sys_setns
      syscall: true
      args:
        - index: 0
          type: int
      selectors:
        - matchActions:
            - action: Post
              rateLimit: "1m"
    - call: __x64_sys_mount
      syscall: true
      args:
        - index: 0
          type: string
        - index: 1
          type: string
      selectors:
        - matchArgs:
            - index: 1
              operator: Prefix
              values:
                - "/proc"
                - "/sys"
          matchActions:
            - action: Post
```

### Auditd Rules for Host Monitoring

```bash
# Monitor namespace changes
-a always,exit -F arch=b64 -S setns -S unshare -k container_escape
-a always,exit -F arch=b64 -S mount -F auid>=1000 -k container_mount
-a always,exit -F arch=b64 -S ptrace -k container_ptrace

# Monitor /proc/1/ns access
-w /proc/1/ns/ -p r -k ns_access
```

## Workflow

### Step 1: Deploy Falco with Escape Rules

```bash
helm install falco falcosecurity/falco \
  --set falcosidekick.enabled=true \
  --set customRules.escape-rules\.yaml="$(cat escape-rules.yaml)"
```

### Step 2: Run Escape Attempt Detection Audit

```bash
node scripts/agent.js --namespace default --output /tmp/escape-audit.json
```

### Step 3: Analyze Falco Alerts

```bash
kubectl logs -l app.kubernetes.io/name=falco -n falco | \
  grep -i "escape\|nsenter\|cgroup\|mount.*host"
```

### Step 4: Correlate with Auditd

```bash
ausearch -k container_escape --start today | aureport -f
```

## Detection

```yaml
title: Container Escape Attempts Detection
id: 015f1d15-ee9f-4bbf-a90b-bead3ac6d4b2
status: experimental
description: Detects suspicious activity related to detecting container escape attempts techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1611
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```

## Verification

- [ ] Falco rules detect nsenter-based escape attempts
- [ ] Cgroup notify_on_release writes trigger alerts
- [ ] Host path mounts from containers generate warnings
- [ ] Auditd captures namespace manipulation syscalls
- [ ] Tetragon policies monitor setns and mount syscalls
- [ ] Alert pipeline delivers escape notifications within 30 seconds

## References

- [Falco Rules Documentation](https://falco.org/docs/rules/)
- [Tetragon — eBPF Runtime Security](https://tetragon.io/)
- [MITRE ATT&CK T1611 — Escape to Host](https://attack.mitre.org/techniques/T1611/)
- [CIS Docker Benchmark 5.x — Container Runtime](https://www.cisecurity.org/benchmark/docker)
- [Container Escape Techniques — NIST SP 800-190](https://csrc.nist.gov/publications/detail/sp/800-190/final)
