Anomalous Increase in Unique Device Logon Count per User

Kubernetes Container Escape

Query

// K8S Container Escape
// MITRE: T1611 (Escape to Host)  |  Severity: High
CloudProcessEvents
| where Timestamp > ago(1h)
| where ContainerName != "host" and isnotempty(ContainerId)
| where (ProcessName =~ "nsenter" and ProcessCommandLine has_any ("-t 1", "--target 1", "--target=1"))
     or (ProcessName =~ "chroot" and ProcessCommandLine has_any ("/host", "/proc/1/root", "/rootfs"))
     or ProcessCommandLine has_any ("/proc/1/root", "release_agent", "/proc/sys/kernel/core_pattern",
                                    "notify_on_release", "docker.sock", "containerd.sock", "crio.sock")
     or (ProcessName =~ "mount" and ProcessCommandLine has_any ("/dev/sd", "/dev/nvme", "/dev/vd", "/dev/xvd", "cgroup"))
     or (ProcessName =~ "unshare" and ProcessCommandLine has_any ("-U", "--user", "-r", "--map-root-user"))
     or (ProcessName in~ ("ctr", "crictl", "docker", "runc"))
| project Timestamp, ReportId, AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName,
          ContainerImageName, AccountName, ParentProcessName, ProcessName, ProcessCommandLine

About this query

Anomalous Increase in Unique Device Logon Count per User

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1611	Escape to Host	https://attack.mitre.org/techniques/T1611
T1059.004	Unix Shell	https://attack.mitre.org/techniques/T1059/004

Description

Detects attempts to escape a Kubernetes container to the underlying host or gain privileged control over the container runtime. The rule monitors for suspicious process execution involving utilities used for container breakouts, such as mounting host filesystems, interacting with container sockets (docker.sock, containerd.sock), or manipulating kernel patterns and namespaces.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect suspicious activities that might indicate an attempt to escape from a Kubernetes container to the underlying host system. It focuses on identifying processes and commands that are commonly associated with container breakouts or privilege escalation within a containerized environment. Here's a simplified breakdown of what the query does:

Data Source: It analyzes events from CloudProcessEvents within the last hour.
Filter Criteria:
- It excludes processes running directly on the host by ensuring the ContainerName is not "host" and that there is a valid ContainerId.
- It looks for specific process names and command-line arguments that are indicative of container escape attempts. These include:
  - nsenter with commands targeting the host process.
  - chroot with commands accessing host directories.
  - Commands interacting with critical system files or sockets like docker.sock and containerd.sock.
  - mount commands targeting device files or cgroups.
  - unshare commands that manipulate user namespaces.
  - Common container management tools like ctr, crictl, docker, and runc.
Output: The query projects relevant details such as the timestamp, report ID, resource ID, Kubernetes namespace and pod name, container name and image, account name, parent process, process name, and the command line used.

Overall, this query helps security teams monitor for and investigate potential security incidents involving unauthorized access or control over Kubernetes containers.