{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1611","id":"T1611","name":"Escape to Host","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1611","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"c84169aa88ddc1b72b926fc06cbaa06cc5f95002c7001f7a6e0697608cccdb08","description":"Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)\n\nThere are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)\n\nAdditionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)\n\nIn ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.(Citation: Broadcom VMSA-2025-004)\n\nGaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1611","external_id":"T1611"},{"source_name":"Container Escape","description":"0xn3va. (n.d.). Escaping. Retrieved May 27, 2022.","url":"https://0xn3va.gitbook.io/cheat-sheets/container/escaping"},{"source_name":"Broadcom VMSA-2025-004","description":"Broadcom. (2025, March 6). VMSA-2025-0004: Questions & Answers. Retrieved March 26, 2025.","url":"https://github.com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2025-0004"},{"source_name":"Windows Server Containers Are Open","description":"Daniel Prizmant. (2020, July 15). Windows Server Containers Are Open, and Here's How You Can Break Out. Retrieved October 1, 2021.","url":"https://unit42.paloaltonetworks.com/windows-server-containers-vulnerabilities/"},{"source_name":"Docker Overview","description":"Docker. (n.d.). Docker Overview. Retrieved March 30, 2021.","url":"https://docs.docker.com/get-started/overview/"},{"source_name":"Docker Bind Mounts","description":"Docker. (n.d.). Use Bind Mounts. Retrieved March 30, 2021.","url":"https://docs.docker.com/storage/bind-mounts/"},{"source_name":"Trend Micro Privileged Container","description":"Fiser, D., Oliveira, A.. (2019, December 20). Why a Privileged Container in Docker is a Bad Idea. Retrieved March 30, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html"},{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"},{"source_name":"Crowdstrike Kubernetes Container Escape","description":"Manoj Ahuje. (2022, January 31). CVE-2022-0185: Kubernetes Container Escape Using Linux Kernel Exploit. Retrieved July 6, 2022.","url":"https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/"},{"source_name":"Keyctl-unmask","description":"Mark Manning. (2020, July 23). Keyctl-unmask: \"Going Florida\" on The State Of Containerizing Linux Keyrings. Retrieved July 6, 2022.","url":"https://www.antitree.com/2020/07/keyctl-unmask-going-florida-on-the-state-of-containerizing-linux-keyrings/"}],"platforms":["Windows","Linux","Containers","ESXi"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0072","name":"Container Creation","page":"telemetry/DC0072/","kind":"attack_component","category":"Container runtime","description":"Creation of a runtime container object.","collection_focus":"Collect runtime create events and image/container IDs; correlate with API audit to establish the initiating identity.","providers":[{"name":"Docker Engine events","scope":"Daemon lifecycle events for containers and images; collect continuously.","source_id":"docker"},{"name":"Kubernetes API audit","scope":"Control-plane context in Kubernetes, not a replacement for runtime observations.","source_id":"k8s"}],"configuration":["Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.","Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.","Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website."],"configuration_example":null,"required_fields":["container_id","image_digest","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0072","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","image_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.","sources":[{"id":"docker","title":"Docker engine event stream","url":"https://docs.docker.com/reference/cli/docker/system/events/"},{"id":"k8s","title":"Kubernetes audit policies and backends","url":"https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"}],"association":"attack_component","anomaly_design":"Per workload image and namespace: rare process starts, unexpected image/privilege changes and new network relationships. Use workload/deployment identity, not short-lived container IDs alone."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0031","name":"Kernel Module Load","page":"telemetry/DC0031/","kind":"attack_component","category":"Host state and inventory","description":"Loading of code into the operating-system kernel as a module.","collection_focus":"On a Linux lab host, review Audit coverage for supported module-loading syscalls and correlate kernel module inventory; Windows driver-load collection is a separate option.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["host","module_name","action","actor_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0031","collector":"illustrative-lab-collector","observation":{"host":"linux-lab-1","module_name":"lab_module","action":"load","actor_uid":0}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0092","name":"Volume Modification","page":"telemetry/DC0092/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a cloud block-storage volume or its attachment configuration.","collection_focus":"Collect volume modify/attach/detach APIs plus resulting size, encryption and attachment state.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["volume_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0092","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","attribute":"size_gib","before":8,"after":10}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1611","id":"T1611","name":"Escape to Host","domain":"enterprise","platforms":["Windows","Linux","Containers","ESXi"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1611","technique_page":"techniques/enterprise/T1611/","page":"detections/enterprise/T1611/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"402b955c-8fe0-4a8c-b635-622b4ac5f902","title":"Container With A hostPath Mount Created","status":"test","level":"low","logsource":{"category":"application","product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/402b955c-8fe0-4a8c-b635-622b4ac5f902.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml","author":"Leo Tsaousis (@laripping)","kind":"sigma"},{"id":"c5cd1b20-36bb-488d-8c05-486be3d0cb97","title":"Privileged Container Deployed","status":"test","level":"low","logsource":{"category":"application","product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/c5cd1b20-36bb-488d-8c05-486be3d0cb97.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml","author":"Leo Tsaousis (@laripping)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1611-1","technique_id":"T1611","title":"T1611 Escape to Host","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#privilege-escalation","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":90,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L90","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"71c344e9ae09d3a73c49f1372d1fd6933d8822953f57d8325a0ecbfe9e5e0e2b","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(container_process_accesses_host_namespace_or_protected_host_path) -> ALERT","log_sources":[{"title":"Container Runtime Security Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#126-container-runtime-security-logs"},{"title":"System-Call Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#9-system-call-telemetry"},{"title":"Container Runtime Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#118-container-runtime-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0219","name":"Detection Strategy for Escape to Host","url":"https://attack.mitre.org/detectionstrategies/DET0219","stix_id":"x-mitre-detection-strategy--8796c5cc-7e5a-402f-8252-f083aafc5cc9","relationship_id":"relationship--a7131e1e-1898-403a-b431-099e7c62393c","description":"","analytics":[{"id":"AN0612","name":"Analytic 0612","guidance":"Detection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0612","platforms":["Containers"],"tuning":[{"field":"AllowedHostPaths","description":"List of directories permitted for hostPath volumes. Any access beyond these paths may be suspicious."},{"field":"PrivilegedContainerThreshold","description":"Number of privileged container launches expected in the environment. Exceeding this may indicate adversary behavior."}],"log_sources":[{"component_id":"DC0072","component":"Container Creation","name":"docker:daemon","channel":"container create/start with privileged flag or host volume mount","platforms":["Containers"],"analytic_id":"AN0612","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0612","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0072/"},{"component_id":"DC0092","component":"Volume Modification","name":"kubernetes:apiserver","channel":"Pod spec with hostPath or privileged securityContext","platforms":["Containers"],"analytic_id":"AN0612","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0612","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0092/"}]},{"id":"AN0613","name":"Analytic 0613","guidance":"Detection of Linux container escape attempts via syscalls (`unshare`, `keyctl`, `mount`) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0613","platforms":["Linux"],"tuning":[{"field":"SyscallWhitelist","description":"Expected syscalls by containerized workloads. Deviations may signal an escape attempt."},{"field":"TimeWindow","description":"Defines correlation window (e.g., 60s) between suspicious syscalls and follow-on host process activity."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"auditd:SYSCALL","channel":"unshare, mount, keyctl, setns syscalls executed by containerized processes","platforms":["Linux"],"analytic_id":"AN0613","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0613","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:Sysmon","channel":"process creation events linked to container namespaces executing host-level binaries","platforms":["Linux"],"analytic_id":"AN0613","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0613","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0614","name":"Analytic 0614","guidance":"Detection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0614","platforms":["Windows"],"tuning":[{"field":"RestrictedHostDirs","description":"Critical system paths containers should not access (e.g., C:\\Windows, C:\\ProgramData)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0614","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0614","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0614","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0614","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN0615","name":"Analytic 0615","guidance":"Detection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0615","platforms":["ESXi"],"tuning":[{"field":"AllowedKernelModules","description":"Modules permitted in the hypervisor. Loading any module outside of this list may indicate compromise."}],"log_sources":[{"component_id":"DC0031","component":"Kernel Module Load","name":"esxi:vmkernel","channel":"VM exit/entry anomalies, unexpected hypercalls, or kernel module loading","platforms":["ESXi"],"analytic_id":"AN0615","source_url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0615","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0031/"}]}]}],"telemetry_references":[{"id":"DC0072","name":"Container Creation","tag":"Container Creation","page":"telemetry/DC0072/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0031","name":"Kernel Module Load","tag":"Kernel Module Load","page":"telemetry/DC0031/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0092","name":"Volume Modification","tag":"Volume Modification","page":"telemetry/DC0092/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0600","name":"Doki","url":"https://attack.mitre.org/software/S0600","kind":"malware","description":"[Doki](https://attack.mitre.org/software/S0600)’s container was configured to bind the host root directory.(Citation: Intezer Doki July 20)","relationship_id":"relationship--46dd6393-93c7-4e61-8a47-ceecd5b77589","references":[{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has used the BOtB tool that can break out of containers. (Citation: Unit 42 Hildegard Malware) ","relationship_id":"relationship--f47bdd6d-d8d4-450f-b6ff-30da690621b3","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of <code>NtSetInformationSymbolicLink</code>.(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--6c91f220-34c0-4d9a-8e23-e1a4b29742dc","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) can gain a reverse shell on a host node by mounting the Kubernetes hostPath.(Citation: Peirates GitHub)","relationship_id":"relationship--19df36ab-4da3-4077-8b83-6066a546f2e2","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]}],"actors":[{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has deployed privileged containers that mount the filesystem of victim machine.(Citation: Intezer TeamTNT September 2020)(Citation: Aqua TeamTNT August 2020)","relationship_id":"relationship--6f5b07b1-6848-48ce-9a33-f5418e2195be","references":[{"source_name":"Intezer TeamTNT September 2020","description":"Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021.","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"},{"source_name":"Aqua TeamTNT August 2020","description":"Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021.","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]}],"mitigations":[{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Ensure containers are not running as root by default and do not use unnecessary privileges or mounted components. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.(Citation: Kubernetes Hardening Guide)","relationship_id":"relationship--690a7276-e560-4d69-92bc-feecf7d0cc73","references":[{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Use read-only containers, read-only file systems, and minimal images when possible to prevent the running of commands.(Citation: Kubernetes Hardening Guide) Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.(Citation: Kubernetes Security Context)","relationship_id":"relationship--365897c8-a97b-42e0-8fb8-cc08c23545df","references":[{"source_name":"Kubernetes Security Context","description":"Kubernetes. (n.d.). Configure a Security Context for a Pod or Container. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"},{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Remove unnecessary tools and software from containers.","relationship_id":"relationship--f705286a-3372-4343-b74f-cab6ff672774","references":[]},{"id":"M1048","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M1048","kind":"course-of-action","description":"Consider utilizing seccomp, seccomp-bpf, or a similar solution that restricts certain system calls such as mount. In Kubernetes environments, consider defining Pod Security Standards that limit container access to host process namespaces, the host network, and the host file system.(Citation: Kubernetes Hardening Guide)","relationship_id":"relationship--3d5d727d-fa37-4de4-9d31-d8e497c910de","references":[{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Ensure that hosts are kept up-to-date with security patches. ","relationship_id":"relationship--2bd8a230-973b-4aaf-804d-3194501cc720","references":[]}],"candidates":[{"id":"0b2f9520-a17a-4671-9dba-3bd034099fff","name":"Deploy container using nsenter container escape","platforms":["containers"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":5,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml","description":"In this escape `kubectl` is used to launch a new pod, with a container that has the host pids mapped into the container (`hostPID:true`). It uses the alpine linux container image. It runs with privilege on the host (`privileged:true`). When the container is launched the command `nsenter --mount=/proc/1/ns/mnt -- /bin/bash` is ran. Since the host processes have been mapped into the container, the container enters the host namespace, escaping the container.\n\nAdditional Details:\n- https://twitter.com/mauilion/status/1129468485480751104\n- https://securekubernetes.com/scenario_2_attack/\n","inputs":{},"dependencies":[{"description":"Verify docker is installed."},{"description":"Verify docker service is running."},{"description":"Verify kind is in the path."},{"description":"Verify kind-atomic-cluster is created"},{"description":"Verify kubectl is in path"}],"source_definition_sha256":"ec541b1fc3f5915acfb6bbd368888a18518284e3f02303e262362d267b2699e3"},{"id":"39fab1bc-fcb9-406f-bc2e-fe03e42ff0e4","name":"Privilege Escalation via Docker Volume Mapping","platforms":["containers"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml","description":"This test demonstrates privilege escalation by abusing Docker's volume mapping\nfeature to gain access to the host file system. By mounting the root directory\nof the host into a Docker container, the attacker can use chroot to operate as\nroot on the host system.\n","inputs":{"username":{"default":"docker_user","description":"Username that run attack command","type":"string"}},"dependencies":[{"description":"Docker"},{"description":"Docker Privileged User"}],"source_definition_sha256":"658f1e82cb5ec4043e4a4b84e569de0efeb602ecdd8a09a4cd3b60e7bc2865f4"},{"id":"6c499943-b098-4bc6-8d38-0956fc182984","name":"Mount host filesystem to escape privileged Docker container","platforms":["containers"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":5,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml","description":"This technique abuses privileged Docker containers to mount the host's filesystem and then create a cron job to launch a reverse shell as the host's superuser.\nThe container running the test needs be privileged.  It may take up to a minute for this to run due to how often crond triggers a job.\nDev note: the echo to create cron_filename is broken up to prevent localized execution of hostname and id by Powershell. \n","inputs":{"mount_device":{"description":"Path to the device of the host's disk to mount","type":"path","default":"/dev/dm-0"},"mount_point":{"description":"Path where the host filesystem will be mounted","type":"path","default":"/mnt/T1611.002"},"cron_path":{"description":"Path on the host filesystem where cron jobs are stored","type":"path","default":"/etc/cron.d"},"cron_filename":{"description":"Filename of the cron job in cron_path","type":"string","default":"T1611_002"},"listen_address":{"description":"IP address to listen for callback from the host system.","type":"string","default":"`ifconfig eth0 | grep inet | awk '{print $2}'`"},"listen_port":{"description":"TCP Port to listen on for callback from the host system.","type":"integer","default":4444}},"dependencies":[{"description":"Verify mount is installed."},{"description":"Verify container is privileged."},{"description":"Verify mount device (/dev/dm-0) exists."},{"description":"Netcat is installed."},{"description":"IP Address is known."}],"source_definition_sha256":"626cf02e0a515e8743daaf01787a65054cde43e6866901b14f7b15f040d37d1e"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1609":"/ttp-simulation/techniques/enterprise/T1609/","T1068":"/ttp-simulation/techniques/enterprise/T1068/","T1611":"/ttp-simulation/techniques/enterprise/T1611/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1611","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0072","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","image_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0031","collector":"illustrative-lab-collector","observation":{"host":"linux-lab-1","module_name":"lab_module","action":"load","actor_uid":0}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0092","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","attribute":"size_gib","before":8,"after":10}}]}}