Container Compromise via File Creation in System Binary Locations

This threat involves the creation of new files within critical system binary locations inside running Linux containers by malicious actors. Attackers commonly gain initial access to a container, then use tools like curl, wget, or busybox to download and drop malicious executables, scripts, or configuration files into trusted system paths such as /etc, /root, /bin, /usr/bin, /usr/local/bin, or /entrypoint. This technique is used for various malicious purposes, including establishing persistence, executing arbitrary commands, or evading security controls by masquerading as legitimate system components. The activity often originates from interactive sessions or from processes executed from temporary staging areas like /tmp, /dev/shm, or /var/tmp. Detection of such activity is crucial as it signals a potential compromise of the container and could lead to broader impact on the underlying host or adjacent systems.

Attack Chain

1. Initial Container Access: Adversaries gain unauthorized access to a running Linux container, often exploiting a vulnerable application, misconfigured API endpoints, or exposed credentials.
2. Container Environment Reconnaissance: The attacker explores the compromised container's filesystem and environment variables to identify writable directories, available utilities, and potential paths for persistence.
3. Ingress Tool Transfer (Staging): Malicious tools, scripts, or payloads are downloaded into temporary, writable locations within the container, such as /tmp, /dev/shm, or /var/tmp, typically using utilities like curl or wget.
4. Defense Evasion & Persistence (Placement): The downloaded malicious files are then moved or copied from the temporary staging area into critical system binary locations like /usr/local/bin, /etc, /bin, /usr/bin, /root, or /entrypoint. This action serves to establish persistence, hide malicious components, or ensure execution upon container restart.
5. Execution of Malicious Payload: The placed malicious file is executed, either directly by the attacker, triggered through a modified entrypoint script, or initiated through other persistence mechanisms (e.g., cron jobs within the container).
6. Command and Control / Impact: The executed payload establishes command and control (C2) communication, performs data exfiltration, crypto-mining, or further compromises the host system or other containers in the environment.

Impact

Successful exploitation results in unauthorized code execution within a container, potentially leading to container escape, privilege escalation on the underlying host, or compromise of other services. Adversaries can tamper with container execution flow, install persistent backdoors, or exfiltrate sensitive data. If an attacker gains control over system binary locations, they can replace legitimate binaries, inject malicious scripts into startup routines, or establish hidden command and control channels. This can compromise the integrity, confidentiality, and availability of containerized applications and the entire host infrastructure.

Recommendation

• Deploy the Sigma rule "Detect File Creation in Container System Binary Locations" to your SIEM to identify suspicious file write operations.
• Enable comprehensive file event logging for Linux containers, specifically capturing file creation events and associated process information, to provide the necessary telemetry for the rule.
• Implement runtime security policies for containers to prevent write access to critical system binary locations like /etc, /root, /bin, /usr/bin, /usr/local/bin, and /entrypoint.
• Regularly review container images for deviations from baseline configurations and ensure that containers are running with the least privileges (e.g., as non-root users) and with a read-only root filesystem.