Detection of Suspicious Privileged Docker Container Execution

Security analysts have identified a TTP involving the execution of Docker containers with the --privileged flag or the --pid=host namespace configuration on Linux hosts. These configurations grant a container broad access to the host's kernel, hardware devices, and process namespace, effectively blurring the isolation boundaries between the container and the underlying host. Threat actors utilize these techniques during post-exploitation to establish persistent access, escalate privileges, or conduct further operations on the host system. While these settings are sometimes required for legitimate administrative or maintenance workflows, their presence in unauthorized contexts is a strong indicator of malicious intent, such as attempts to escape the container environment. Defenders should focus on monitoring container orchestration and runtime commands to identify anomalous or non-standard container deployments that utilize these elevated execution flags.

Impact

Successful exploitation allows an attacker to bypass container isolation, resulting in full control over the host system, exfiltration of sensitive host-level data, or the establishment of long-term persistence that survives standard container restarts. Unauthorized use of these flags significantly increases the attack surface of containerized infrastructure.

Recommendation

• Deploy the provided Sigma rule to detect docker processes invoked with --privileged or --pid=host command-line arguments.
• Implement a policy-based restriction using admission controllers (e.g., OPA Gatekeeper or Kyverno) to prevent the deployment of privileged containers in production environments.
• Establish an allowlist for known administrative service accounts or maintenance workflows that require privileged access to minimize noise.
• Review all current running containers to identify existing privileged instances and assess the necessity of these permissions.