Escape to Host

let ContainerEscapeBinaries = dynamic(["nsenter", "unshare", "insmod", "modprobe"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ (ContainerEscapeBinaries)
    or (FileName =~ "docker" and ProcessCommandLine has_any ("docker.sock", "/var/run/docker.sock") and ProcessCommandLine has "run")
    or (FileName in~ ("sh", "bash", "python", "python3", "perl") and ProcessCommandLine has_all ("/cgroup", "release_agent"))
    or (FileName =~ "keyctl" and ProcessCommandLine has_any ("session", "link", "show"))
    or (ProcessCommandLine has_all ("mount", "/proc/1/root"))
    or (ProcessCommandLine has_all ("nsenter", "-t 1"))
    or (FileName =~ "chroot" and ProcessCommandLine has "/host")
| extend EscapeType = case(
    ProcessCommandLine has_all ("nsenter", "-t 1"), "Namespace Entry - PID 1 Targeting",
    FileName =~ "nsenter", "Namespace Entry (nsenter)",
    FileName =~ "unshare" and ProcessCommandLine has_any ("--mount", "--pid", "--net", "--user"), "Namespace Unshare",
    FileName =~ "keyctl" and ProcessCommandLine has_any ("session", "link"), "Keychain Secret Theft",
    FileName =~ "docker" and ProcessCommandLine has "docker.sock", "Docker Socket Abuse",
    ProcessCommandLine has_all ("/cgroup", "release_agent"), "Cgroup Release Agent Escape",
    FileName in~ ("insmod", "modprobe"), "Kernel Module Load",
    ProcessCommandLine has_all ("mount", "/proc/1/root"), "Host Filesystem Mount via /proc",
    FileName =~ "chroot" and ProcessCommandLine has "/host", "Chroot Escape",
    "Container Escape Indicator"
)
| extend RiskScore = case(
    EscapeType =~ "Cgroup Release Agent Escape", 95,
    EscapeType =~ "Namespace Entry - PID 1 Targeting", 90,
    EscapeType =~ "Host Filesystem Mount via /proc", 90,
    EscapeType =~ "Docker Socket Abuse", 85,
    EscapeType =~ "Namespace Entry (nsenter)", 80,
    EscapeType =~ "Kernel Module Load", 80,
    EscapeType =~ "Keychain Secret Theft", 75,
    EscapeType =~ "Namespace Unshare", 70,
    65
)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine, EscapeType, RiskScore,
    ProcessId, InitiatingProcessId, SHA256
| order by RiskScore desc, TimeGenerated desc

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval proc=lower(mvindex(split(Image, "/"), -1)), cmd=lower(CommandLine)
| eval is_escape=case(
    match(proc, "^nsenter$"), 1,
    match(proc, "^unshare$") AND match(cmd, "(--mount|--pid|--net|--user)"), 1,
    match(proc, "^(insmod|modprobe)$"), 1,
    match(proc, "^keyctl$") AND match(cmd, "(session|link|show)"), 1,
    match(proc, "^docker$") AND match(cmd, "docker\.sock") AND match(cmd, "run"), 1,
    match(cmd, "/cgroup") AND match(cmd, "release_agent"), 1,
    match(cmd, "/proc/1/root") AND match(cmd, "mount"), 1,
    match(cmd, "nsenter") AND match(cmd, "-t 1"), 1,
    1=1, 0
  )
| where is_escape=1
| eval escape_type=case(
    match(cmd, "nsenter") AND match(cmd, "-t 1"), "Namespace Entry - PID 1 Targeting",
    match(proc, "^nsenter$"), "Namespace Entry",
    match(proc, "^unshare$"), "Namespace Unshare",
    match(proc, "^(insmod|modprobe)$"), "Kernel Module Load",
    match(proc, "^keyctl$"), "Keychain Secret Theft",
    match(proc, "^docker$") AND match(cmd, "docker\.sock"), "Docker Socket Abuse",
    match(cmd, "release_agent"), "Cgroup Release Agent Escape",
    match(cmd, "/proc/1/root"), "Host Filesystem via /proc",
    1=1, "Container Escape Indicator"
  )
| eval severity=case(
    match(escape_type, "(Cgroup Release Agent|Namespace Entry - PID 1|Host Filesystem)"), "critical",
    match(escape_type, "(Docker Socket|Kernel Module|Namespace Entry)"), "high",
    1=1, "medium"
  )
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, escape_type, severity, ProcessId, ProcessGuid
| sort -_time

process where process.name in ("docker", "kubectl", "crictl", "ctr", "podman", "nsenter", "runc") and (process.args : ("exec", "run", "create", "deploy", "--privileged", "--pid=host", "--net=host", "--cap-add", "SYS_ADMIN", "nsenter") or process.command_line : ("*--privileged*", "*--pid=host*", "*--cap-add=SYS_ADMIN*", "*nsenter*pid*1*"))

SELECT username as "Username", "UTF8(payload)" as "CommandLine", sourceip as "SourceIP", devicetime as "EventTime", CASE WHEN "CommandLine" ILIKE '%--privileged%' OR "CommandLine" ILIKE '%nsenter%pid%1%' THEN 90 WHEN "CommandLine" ILIKE '%--pid=host%' OR "CommandLine" ILIKE '%--cap-add=SYS_ADMIN%' THEN 80 WHEN "CommandLine" ILIKE '%docker exec%' OR "CommandLine" ILIKE '%kubectl exec%' THEN 65 ELSE 50 END as "RiskScore" FROM events WHERE eventid = 4688 AND ("CommandLine" ILIKE '%docker%' OR "CommandLine" ILIKE '%kubectl%' OR "CommandLine" ILIKE '%crictl%' OR "CommandLine" ILIKE '%podman%' OR "CommandLine" ILIKE '%nsenter%') ORDER BY "RiskScore" DESC LAST 24 HOURS

_sourceCategory=endpoint/linux OR _sourceCategory=endpoint/kubernetes | json auto | where process_name in ("docker", "kubectl", "crictl", "ctr", "podman", "nsenter", "runc") | if(matches(command_line, "*--privileged*") or matches(command_line, "*nsenter*pid*1*"), "Critical", if(matches(command_line, "*--pid=host*") or matches(command_line, "*--cap-add=SYS_ADMIN*"), "High", "Medium")) as RiskLevel | stats count by user_name, process_name, command_line, RiskLevel | sort by count desc

rule detect_container_abuse {
  meta:
    author = "Argus"
    description = "Detects suspicious container management and escape attempts"
    severity = "HIGH"
    technique = "T1609_T1611"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.target.process.file.full_path = "/usr/bin/docker" or
      $e.target.process.file.full_path = "/usr/bin/kubectl" or
      $e.target.process.file.full_path = "/usr/bin/nsenter" or
      re.regex($e.target.process.file.full_path, `crictl|podman|runc`) nocase
    )
    (
      re.regex($e.target.process.command_line, `--privileged|--pid=host|--cap-add=SYS_ADMIN|nsenter.*--pid.*1`) nocase
    )
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /docker|kubectl|crictl|podman|nsenter|runc/i
| case {
    CommandHistory = /--privileged|nsenter.*pid.*1/i | RiskLevel := "Critical";
    CommandHistory = /--pid=host|--cap-add=SYS_ADMIN|--net=host/i | RiskLevel := "High";
    CommandHistory = /exec|run.*-it/i | RiskLevel := "Medium";
    * | RiskLevel := "Low"
  }
| where RiskLevel in ("Critical", "High", "Medium")
| table([@timestamp, UserName, ComputerName, ImageFileName, CommandHistory, RiskLevel])