T1611 Escape to Host — Detection Rules

Source-backed rule directory

• Container With A hostPath Mount Created · test · low · {"category":"application","product":"kubernetes","service":"audit"}
• Privileged Container Deployed · test · low · {"category":"application","product":"kubernetes","service":"audit"}

Atlas deterministic concepts

T1611 Escape to Host

MATCH(container_process_accesses_host_namespace_or_protected_host_path) -> ALERT

• Container Runtime Security Logs
• System-Call Telemetry
• Container Runtime Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0219 Detection Strategy for Escape to Host

AN0612 Analytic 0612

Detection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.

AN0613 Analytic 0613

Detection of Linux container escape attempts via syscalls (`unshare`, `keyctl`, `mount`) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.

AN0614 Analytic 0614

Detection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.

AN0615 Analytic 0615

Detection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.