Detection of Host Root Directory Mounts in Docker Containers

This threat involves the exploitation of misconfigured Docker containers to facilitate container escape and privilege escalation on Linux hosts. By mounting the host's root directory (/) into a container using the -v or --volume flag with a syntax such as -v /:/host, an attacker gains full read/write access to the underlying host filesystem. This configuration is particularly dangerous when the container is executed with --privileged flags or by a user with root-level access. Defenders should monitor for Docker process execution command lines that include volume mapping arguments targeting the root directory, as this is a primary technique used by threat actors to break out of containerized environments and achieve persistence or exfiltration on the host.

Attack Chain

1. Attacker gains initial access to a Linux host where Docker is running.
2. Attacker enumerates available container images or existing running containers.
3. Attacker initiates a new container or modifies an existing one to include a volume mount parameter.
4. The container is launched with the argument -v /:/host or similar to map the host root directory.
5. The attacker enters the container shell, now having access to the host's /etc/shadow, SSH keys, or binaries.
6. Attacker modifies host-level system files (e.g., /etc/crontab or .ssh/authorized_keys) to gain persistent access.
7. Attacker executes commands from within the container that affect the host filesystem to escalate privileges to root.

Impact

Successful exploitation allows an attacker to move from a containerized environment to the host system. This can lead to full system compromise, data theft, or the deployment of persistent backdoors on the host. This technique is often observed in the post-exploitation phase of cloud-native environment attacks, specifically targeting misconfigured infrastructure-as-a-service or CI/CD pipelines.

Recommendation

• Deploy the Sigma rule below to detect instances of Docker containers mounting the host root directory.
• Audit all Docker-related process creation events via EDR/Sysmon telemetry for unauthorized volume mounting.
• Enforce restrictive security policies on container runtimes to prevent the use of --privileged mode or broad volume mounts.