Detection of Privileged Container Creation with Host Directory Mount

This threat involves the exploitation of misconfigured container environments where privileged containers are deployed with host filesystems mounted directly into the container's namespace. By utilizing the --privileged flag alongside a bind-mount of the host root directory (e.g., -v /:/host), an attacker can effectively bypass container isolation mechanisms. Once inside such a container, the attacker gains direct read and write access to sensitive host files, devices, and configuration paths. This access is frequently leveraged to perform container escapes, often through chrooting into the host root or manipulating namespaces via nsenter. These techniques allow the attacker to alter critical system files, install persistence mechanisms, and pivot into the broader infrastructure, representing a significant risk to the integrity and security of the containerized node.

Attack Chain

1. An attacker identifies a compromised node with access to the container runtime (e.g., Docker socket).
2. The attacker executes a container deployment command using the --privileged flag to disable standard security profiles.
3. The attacker adds a bind-mount argument, specifically mounting the host root filesystem (e.g., -v /:/host) into the container.
4. Upon container startup, the attacker gains shell access within the privileged environment (T1609/T1610).
5. The attacker performs a chroot command to set the root directory to the mounted host filesystem path.
6. The attacker interacts with sensitive host configuration files such as /etc/shadow, /etc/sudoers, or /root/.ssh.
7. The attacker modifies systemd units or installs SSH keys to establish long-term persistence on the host.
8. The attacker initiates a lateral movement or exfiltration phase from the compromised host (T1611).

Impact

Successful exploitation allows for a full container escape, resulting in complete compromise of the underlying host operating system. This facilitates privilege escalation, the theft of sensitive data, the deployment of persistent backdoors, and the potential compromise of the entire container cluster if the host is a Kubernetes node.

Recommendation

1. Deploy the provided Sigma rule to monitor for suspicious process execution patterns related to privileged container creation.
2. Implement Admission Control policies (e.g., OPA Gatekeeper or Kyverno) to deny the use of --privileged containers and hostPath mounts of the host root.
3. Enable File Integrity Monitoring (FIM) on critical host paths, specifically /etc, /root/.ssh, and /var/lib/kubelet to detect unauthorized modifications.
4. Ensure Docker/CRI sockets are restricted to authorized users and groups only.
5. Conduct audits of existing container configurations to identify and remediate instances where --privileged mode or broad hostPath mounts are in use.