KQL Search

Query Details

Kubernetes Container Escape

Query

CloudProcessEvents
| where Timestamp > ago(1h)
| where ContainerName != "host" and isnotempty(ContainerId)
| where (ProcessName =~ "nsenter" and ProcessCommandLine has_any ("-t 1", "--target 1", "--target=1"))
     or (ProcessName =~ "chroot" and ProcessCommandLine has_any ("/host", "/proc/1/root", "/rootfs"))
     or ProcessCommandLine has_any ("/proc/1/root", "release_agent", "/proc/sys/kernel/core_pattern",
                                    "notify_on_release", "docker.sock", "containerd.sock", "crio.sock")
     or (ProcessName =~ "mount" and ProcessCommandLine has_any ("/dev/sd", "/dev/nvme", "/dev/vd", "/dev/xvd", "cgroup"))
     or (ProcessName =~ "unshare" and ProcessCommandLine has_any ("-U", "--user", "-r", "--map-root-user"))
     or (ProcessName in~ ("ctr", "crictl", "docker", "runc"))
| project Timestamp, ReportId, AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName,
          ContainerImageName, AccountName, ParentProcessName, ProcessName, ProcessCommandLine

About this query

Kubernetes Container Escape

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1611Escape to Hosthttps://attack.mitre.org/techniques/T1611
T1059.004Unix Shellhttps://attack.mitre.org/techniques/T1059/004

Description

Detects attempts to escape a Kubernetes container to the underlying host or gain privileged control over the container runtime. The rule monitors for suspicious process execution involving utilities used for container breakouts, such as mounting host filesystems, interacting with container sockets (docker.sock, containerd.sock), or manipulating kernel patterns and namespaces.

Author <Optional>

Defender XDR

Explanation

This query is designed to detect potential security threats related to Kubernetes containers. Specifically, it looks for attempts to escape from a container to the host system or gain unauthorized control over the container environment. Here's a simplified breakdown of what the query does:

  1. Data Source: It examines cloud process events within the last hour.

  2. Container Filtering: It filters out events that are not related to the host itself and ensures that the events are associated with a specific container by checking that the ContainerId is not empty.

  3. Suspicious Activity Detection: The query looks for specific processes and command-line arguments that are commonly associated with container escape attempts or unauthorized access:

    • nsenter: Used with certain arguments to target the host's process namespace.
    • chroot: Used to change the root directory to a host directory, indicating an attempt to access the host filesystem.
    • Command-line arguments: It checks for access to sensitive files or sockets like docker.sock, containerd.sock, and others that could indicate an attempt to interact with the container runtime.
    • mount: Used with arguments that suggest mounting host filesystems.
    • unshare: Used with arguments that manipulate user namespaces.
    • Container management tools: It checks for the use of tools like ctr, crictl, docker, and runc, which could be used to control containers.

  4. Output: If any suspicious activity is detected, the query outputs relevant details such as the timestamp, resource ID, Kubernetes namespace and pod name, container name and image, account name, parent process name, process name, and the full command line used.

Overall, this query helps security teams monitor and identify potential container escape attempts or unauthorized access to the container runtime in a Kubernetes environment.