What it does. Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_ADMIN, privileged, hostPath, kernel exploit, syscall. Do not use for Falco rule syntax itself - use detecting-container-escape-with-falco-rules; for a static configuration sweep use performing-container-escape-detection. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-container-escape-attempts, or copy the skill folder into ~/.claude/skills/detecting-container-escape-attempts/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-attempts/SKILL.md
SKILL.md (verbatim)
name: detecting-container-escape-attempts
description: >-
Detects container escape at runtime across tooling - namespace manipulation, capability
abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which
signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the
collection. Use when deciding what breakout behaviour to monitor, investigating a suspected
Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors.
Keywords: container escape, breakout, namespaces, CAP_SYS_ADMIN, privileged, hostPath,
kernel exploit, syscall. Do not use for Falco rule syntax itself - use
detecting-container-escape-with-falco-rules; for a static configuration sweep use
performing-container-escape-detection.
domain: cybersecurity
subdomain: container-security
tags:
- containers
- kubernetes
- docker
- security
- runtime-security
- escape-detection
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Platform Monitoring
- Process Code Segment Verification
- Stack Frame Canary Validation
- Segment Address Offset Randomization
- Process Analysis
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525
Detecting Container Escape Attempts
Overview
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.
When to Use
- When investigating security incidents that require detecting container escape attempts
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Linux host with kernel 5.10+ (eBPF support)
- Falco 0.37+ installed (kernel module or eBPF probe)
- Docker Engine or containerd runtime
- auditd configured
- Root access for eBPF/kernel module loading
Core Concepts
Common Container Escape Vectors
| Vector |
Technique |
MITRE ID |
| Privileged containers |
Mount host filesystem, load kernel modules |
T1611 |
| Docker socket mount |
Create privileged container from within |
T1610 |
| Kernel exploits |
CVE-2022-0185 (fsconfig), Dirty Pipe, runc CVEs |
T1068 |
| Capability abuse |
CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN |
T1548 |
| Sensitive mounts |
/proc/sysrq-trigger, /proc/kcore, cgroup release_agent |
T1611 |
| Namespace escape |
nsenter, unshare to host namespaces |
T1611 |
| Symlink/bind mount |
Escape through /proc/self/root |
T1611 |
Detection Layers
- Syscall monitoring - eBPF/kernel module captures syscalls in real-time
- File integrity - Detect modification of escape-enabling paths
- Process monitoring - Track process creation, namespace changes
- Network monitoring - Detect container-to-host connections
- Audit logging - Linux auditd for capability and mount operations
Workflow
Step 1: Deploy Falco for Runtime Detection
# falco-values.yaml for Helm deployment
falco:
driver:
kind: ebpf # or modern_ebpf for kernel 5.8+
rules_files:
- /etc/falco/falco_rules.yaml
- /etc/falco/falco_rules.local.yaml
- /etc/falco/rules.d
json_output: true
json_include_output_property: true
http_output:
enabled: true
url: "http://falcosidekick:2801"
grpc:
enabled: true
priority: warning
# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
--namespace falco-system --create-namespace \
-f falco-values.yaml
Step 2: Custom Falco Rules for Escape Detection
# /etc/falco/rules.d/container_escape.yaml
# Detect container escape via privileged container
- rule: Container Escape via Privileged Mode
desc: Detect attempts to escape container using privileged capabilities
condition: >
spawned_process and container and
(proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or
(proc.name = chroot and proc.args contains "/host"))
output: >
Container escape attempt via privileged operation
(user=%user.name container=%container.name image=%container.image.repository
command=%proc.cmdline pid=%proc.pid %container.info)
priority: CRITICAL
tags: [container, escape, T1611]
# Detect Docker socket access from container
- rule: Container Access to Docker Socket
desc: Detect container reading/writing to Docker socket
condition: >
(open_read or open_write) and container and
fd.name = /var/run/docker.sock
output: >
Docker socket accessed from container
(user=%user.name container=%container.name image=%container.image.repository
fd=%fd.name command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, docker_socket]
# Detect sensitive proc filesystem access
- rule: Container Access to Sensitive Proc Paths
desc: Detect container accessing host-sensitive proc paths
condition: >
open_read and container and
(fd.name startswith /proc/sysrq-trigger or
fd.name startswith /proc/kcore or
fd.name startswith /proc/kmsg or
fd.name startswith /proc/kallsyms or
fd.name startswith /sys/kernel)
output: >
Sensitive proc/sys access from container
(user=%user.name container=%container.name path=%fd.name
command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, proc_access]
# Detect cgroup escape technique
- rule: Container Cgroup Escape Attempt
desc: Detect writing to cgroup release_agent (escape technique)
condition: >
open_write and container and
(fd.name contains release_agent or
fd.name contains notify_on_release)
output: >
Cgroup escape attempt detected
(user=%user.name container=%container.name path=%fd.name
command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, cgroup]
# Detect kernel module loading from container
- rule: Container Loading Kernel Module
desc: Detect container attempting to load kernel modules
condition: >
spawned_process and container and
(proc.name in (modprobe, insmod, rmmod) or
(evt.type = init_module or evt.type = finit_module))
output: >
Kernel module load attempt from container
(user=%user.name container=%container.name command=%proc.cmdline
%container.info)
priority: CRITICAL
tags: [container, escape, kernel_module]
# Detect namespace manipulation
- rule: Container Namespace Manipulation
desc: Detect setns/unshare syscalls from container
condition: >
container and (evt.type = setns or evt.type = unshare) and
not proc.name in (containerd-shim, runc)
output: >
Namespace manipulation from container
(user=%user.name container=%container.name syscall=%evt.type
command=%proc.cmdline %container.info)
priority: CRITICAL
tags: [container, escape, namespace]
# Detect mount operations from container
- rule: Container Mount Sensitive Filesystem
desc: Detect container mounting host filesystems
condition: >
spawned_process and container and proc.name = mount and
(proc.args contains "/dev/" or proc.args contains "proc" or
proc.args contains "sysfs")
output: >
Sensitive mount operation from container
(user=%user.name container=%container.name command=%proc.cmdline
%container.info)
priority: HIGH
tags: [container, escape, mount]
{
"defaultAction": "SCMP_ACT_ERRNO",
"archMap": [
{ "architecture": "SCMP_ARCH_X86_64", "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"] }
],
"syscalls": [
{
"names": [
"read", "write", "open", "close", "stat", "fstat", "lstat",
"poll", "lseek", "mmap", "mprotect", "munmap", "brk",
"rt_sigaction", "rt_sigprocmask", "ioctl", "access",
"pipe", "select", "sched_yield", "dup", "dup2",
"nanosleep", "getpid", "socket", "connect", "accept",
"sendto", "recvfrom", "bind", "listen", "getsockname",
"getpeername", "socketpair", "setsockopt", "getsockopt",
"clone", "fork", "vfork", "execve", "exit", "wait4",
"kill", "getuid", "getgid", "geteuid", "getegid",
"epoll_create", "epoll_wait", "epoll_ctl", "epoll_create1",
"futex", "set_tid_address", "set_robust_list",
"openat", "newfstatat", "readlinkat", "fchownat",
"clock_gettime", "clock_getres", "clock_nanosleep",
"getrandom", "memfd_create", "statx", "rseq"
],
"action": "SCMP_ACT_ALLOW"
},
{
"names": ["unshare", "setns", "mount", "umount2", "pivot_root",
"init_module", "finit_module", "delete_module",
"kexec_load", "kexec_file_load", "ptrace",
"reboot", "swapon", "swapoff", "sethostname",
"setdomainname", "keyctl", "bpf"],
"action": "SCMP_ACT_LOG",
"comment": "Log escape-relevant syscalls for detection"
}
]
}
Step 4: Audit Rules for Container Escape
# /etc/audit/rules.d/container-escape.rules
# Monitor namespace operations
-a always,exit -F arch=b64 -S setns -S unshare -k container_escape
-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount
-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_module
-a always,exit -F arch=b64 -S ptrace -k process_trace
# Monitor sensitive paths
-w /var/run/docker.sock -p rwxa -k docker_socket
-w /proc/sysrq-trigger -p w -k sysrq
-w /proc/kcore -p r -k kcore_read
# Monitor container runtime
-w /usr/bin/runc -p x -k container_runtime
-w /usr/bin/containerd -p x -k container_runtime
-w /usr/bin/docker -p x -k container_runtime
Step 5: Real-Time Alert Pipeline
# Falcosidekick configuration for alert routing
config:
slack:
webhookurl: "https://hooks.slack.com/services/xxx"
minimumpriority: "critical"
messageformat: |
*Container Escape Alert*
Rule: {{ .Rule }}
Priority: {{ .Priority }}
Output: {{ .Output }}
elasticsearch:
hostport: "https://elasticsearch:9200"
index: "falco-alerts"
minimumpriority: "warning"
pagerduty:
routingkey: "xxxx"
minimumpriority: "critical"
Validation Commands
# Test Falco rules with event generator
kubectl run falco-event-generator \
--image=falcosecurity/event-generator \
--restart=Never \
-- run syscall --action PtraceAttachContainer
# Check Falco alerts
kubectl logs -n falco-system -l app.kubernetes.io/name=falco --tail=50
# Verify seccomp profile is loaded
docker inspect --format '{{.HostConfig.SecurityOpt}}' <container-id>
# Check audit logs for escape-related events
ausearch -k container_escape --interpret
References
Other files in this skill
assets/template.md (verbatim)
Container Escape Detection Assessment Template
| Field |
Value |
| Cluster Name |
|
| Container Runtime |
Docker / containerd / CRI-O |
| Kernel Version |
|
| Runtime Detection Tool |
Falco / Sysdig / Tetragon |
| Assessment Date |
|
Escape Surface Inventory
| Container |
Privileged |
Capabilities |
Host NS |
Docker Socket |
Risk Score |
|
|
|
|
|
/10 |
Detection Rules Deployed
| Rule |
Tool |
Detects |
Status |
| Namespace manipulation |
Falco |
setns/unshare from container |
|
| Docker socket access |
Falco |
/var/run/docker.sock read/write |
|
| Kernel module loading |
Falco |
modprobe/insmod from container |
|
| Sensitive proc access |
Falco |
/proc/sysrq-trigger, /proc/kcore |
|
| Cgroup escape |
Falco |
release_agent write |
|
| Mount operations |
auditd |
mount/umount2 syscalls |
|
| Binary replacement |
FIM |
runc/containerd binary changes |
|
Findings
| Priority |
Container |
Risk Factor |
Score |
Remediation |
| P1 |
|
|
|
|
| P2 |
|
|
|
|
| Finding |
Action Required |
Owner |
Status |
Verified |
|
|
|
|
|
references/api-reference.md (verbatim)
API Reference: Detecting Container Escape Attempts
Common Escape Vectors (MITRE ATT&CK)
| Vector |
Technique |
MITRE ID |
| Privileged container |
Mount host FS, load modules |
T1611 |
| Docker socket mount |
Create privileged container |
T1610 |
| Kernel exploits |
CVE-2022-0185, Dirty Pipe |
T1068 |
| Capability abuse |
SYS_ADMIN, SYS_PTRACE |
T1548 |
| Sensitive mounts |
/proc/sysrq-trigger, cgroup release_agent |
T1611 |
| Namespace escape |
nsenter, unshare |
T1611 |
Docker CLI Inspection
# Check if container is privileged
docker inspect --format='{{.HostConfig.Privileged}}' <container>
# Check added capabilities
docker inspect --format='{{.HostConfig.CapAdd}}' <container>
# Check PID namespace mode
docker inspect --format='{{.HostConfig.PidMode}}' <container>
# Check volume mounts
docker inspect --format='{{range .Mounts}}{{.Source}}:{{.Destination}} {{end}}' <container>
{
"time": "2024-01-15T10:30:00.000Z",
"rule": "Container Escape via Privileged Mode",
"priority": "Critical",
"output": "Container escape attempt...",
"output_fields": {
"container.name": "attacker-pod",
"container.image.repository": "alpine",
"proc.cmdline": "nsenter -t 1 -m -u -i -n"
},
"tags": ["container", "escape", "T1611"]
}
Linux Audit Rules for Escape Detection
# /etc/audit/rules.d/container-escape.rules
-a always,exit -F arch=b64 -S setns -S unshare -k container_escape
-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount
-a always,exit -F arch=b64 -S init_module -S finit_module -k kernel_module
-w /var/run/docker.sock -p rwxa -k docker_socket
Dangerous Linux Capabilities
| Capability |
Escape Risk |
| CAP_SYS_ADMIN |
Mount filesystems, manage cgroups |
| CAP_SYS_PTRACE |
Trace/debug any process |
| CAP_NET_ADMIN |
Network namespace manipulation |
| CAP_SYS_MODULE |
Load/unload kernel modules |
| CAP_DAC_READ_SEARCH |
Bypass file read permissions |
CLI Usage
python agent.py --falco-log /var/log/falco/events.json
python agent.py --audit-log /var/log/audit/audit.log
python agent.py --check-containers
python agent.py --container-id abc123
references/standards.md (verbatim)
Standards Reference - Container Escape Detection
MITRE ATT&CK for Containers
T1611 - Escape to Host
- Tactic: Privilege Escalation
- Description: Adversaries may escape container isolation and gain access to the host
- Sub-techniques: Privileged container, nsenter, cgroup escape, kernel exploit
- Detection: Monitor for namespace manipulation, sensitive path access, privilege changes
T1610 - Deploy Container
- Tactic: Execution
- Description: Deploy a new container using Docker socket access from within a container
T1068 - Exploitation for Privilege Escalation
- Tactic: Privilege Escalation
- Description: Exploit kernel vulnerabilities for container escape (Dirty Pipe, runc CVEs)
T1548 - Abuse Elevation Control Mechanism
- Sub-technique: T1548.004 - Elevated Execution with Prompt
- Description: Abuse Linux capabilities like CAP_SYS_ADMIN for escape
Known Container Escape CVEs
| CVE |
Component |
Description |
CVSS |
| CVE-2024-21626 |
runc |
Working directory escape via /proc/self/fd leak |
8.6 |
| CVE-2022-0185 |
Linux kernel |
fsconfig heap overflow, namespace escape |
8.4 |
| CVE-2022-0847 |
Linux kernel |
Dirty Pipe - arbitrary file overwrite |
7.8 |
| CVE-2021-22555 |
Linux kernel |
Netfilter heap OOB, container escape |
7.8 |
| CVE-2020-15257 |
containerd |
Abstract socket namespace escape |
5.2 |
| CVE-2019-5736 |
runc |
Binary overwrite, host code execution |
8.6 |
NIST SP 800-190 - Application Container Security Guide
Container Runtime Security
- Monitor containers for anomalous behavior
- Detect attempts to access host namespaces
- Alert on kernel module loading from containers
- Implement syscall filtering with seccomp
Linux Capabilities Required for Escape
| Capability |
Escape Risk |
Description |
| CAP_SYS_ADMIN |
Critical |
Mount filesystems, namespace manipulation |
| CAP_SYS_PTRACE |
Critical |
ptrace processes, inspect memory |
| CAP_NET_ADMIN |
High |
Network namespace manipulation |
| CAP_SYS_MODULE |
Critical |
Load kernel modules |
| CAP_SYS_RAWIO |
High |
Raw I/O access, iopl/ioperm |
| CAP_DAC_OVERRIDE |
High |
Bypass file read/write permission |
| CAP_DAC_READ_SEARCH |
Medium |
Bypass file read permission |
| CAP_MKNOD |
Medium |
Create device files |
references/workflows.md (verbatim)
Workflows - Container Escape Detection
Workflow 1: Real-Time Detection Pipeline
[Container Syscall] --> [eBPF/Kernel Module] --> [Falco Engine]
| |
v v
Syscall captured Rule evaluation
(setns, mount, |
ptrace, etc.) +-------------+-------------+
| |
v v
Match found No match
| (normal)
v
[Alert Generated]
|
+---------+---------+
| | |
v v v
Slack SIEM PagerDuty
Alert Log Incident
Workflow 2: Escape Attempt Investigation
Step 1: Triage alert
- Identify container, image, namespace
- Check if container is privileged
- Determine escape vector attempted
Step 2: Immediate containment
- kubectl delete pod <pod-name> -n <namespace> (if active escape)
- kubectl cordon <node> (if node compromised)
- Network isolate the node
Step 3: Forensic collection
- Capture container filesystem: docker export <id> > container.tar
- Collect Falco events for timeline
- Dump process tree: ps auxf
- Check for new processes on host
- Audit logs: ausearch -k container_escape
Step 4: Root cause analysis
- Was the container privileged?
- What capabilities were granted?
- Was Docker socket mounted?
- Which vulnerability was exploited?
Step 5: Remediation
- Patch kernel/runtime vulnerability
- Remove excessive capabilities
- Apply PSS restricted profile
- Update seccomp profiles
Workflow 3: Proactive Escape Surface Audit
[Inventory all containers] --> [Check for escape risk factors]
|
+-----------+-----------+
| | |
v v v
Privileged? Docker sock? Host NS?
CAP_SYS_ADMIN? mounted? hostPID?
| | |
+-----------+-----------+
|
v
[Risk Score per container]
|
+---------+---------+
| |
v v
HIGH risk LOW risk
Remediate Monitor
immediately continuously
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.