MITRE ATT&CK technique
Escape to Host detection rulesT1611
Escape to Host (T1611) is a MITRE ATT&CK technique in the Privilege Escalation tactic. This page lists the 2 community-maintained Sigma detection rules in the library mapped to T1611 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target kubernetes.
Top products
Tactic
Container With A hostPath Mount Created
lowDetects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.
kubernetes · application
Privileged Container Deployed
lowDetects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields
kubernetes · application