Applied Cybernetics Group
T1611 Escape to Host
- Technique
T1611- Tactics
- Privilege Escalation
- Research, 90 days
- 0
- KEV CVEs mapped
- 3
- SigmaHQ rules
- 2
- Elastic, Splunk
- 54
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1611
MITRE description
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview) There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask) Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open) In ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.(Citation: Broadcom VMSA-2025-004) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
Elastic and Splunk rules
- Privileged Container Creation with Host Directory Mount (elastic)
- AWS EKS API Server Proxying Request to Kubelet (elastic)
- AWS EKS Container Created with Excessive Linux Capabilities (elastic)
- AWS EKS Ephemeral Container Added to Pod (elastic)
- AWS EKS Pod Created With HostIPC (elastic)
- AWS EKS Pod Created With HostNetwork (elastic)
- AWS EKS Pod Created With HostPID (elastic)
- AWS EKS Pod Created with a Sensitive hostPath Volume (elastic)
- AWS EKS Privileged Pod Created (elastic)
- Suspicious Container Runtime CLI Execution (elastic)
- Chroot Execution Detected via Defend for Containers (elastic)
- DebugFS Execution Detected via Defend for Containers (elastic)
- Mount Execution Detected via Defend for Containers (elastic)
- Nsenter Execution with Target Flag Inside Container (elastic)
- Potential notify_on_release Container Escape Detected via Defend for Containers (elastic)
- Potential release_agent Container Escape Detected via Defend for Containers (elastic)
- Namespace Manipulation Using Unshare in a Container (elastic)
- GKE API Server Proxying Request to Kubelet (elastic)
- GKE Ephemeral Container Added to Pod (elastic)
- GKE Container Created with Excessive Linux Capabilities (elastic)
- GKE Pod Created With HostIPC (elastic)
- GKE Pod Created With HostNetwork (elastic)
- GKE Pod Created With HostPID (elastic)
- GKE Privileged Pod Created (elastic)
- GKE Pod Created with a Sensitive hostPath Volume (elastic)
Showing 25 of 54.