Linux Container: Potential Container Escape via Chroot Execution

The detection rule identifies the use of the chroot utility within Linux containers, a technique commonly associated with container escape attempts. By executing chroot and targeting mounted host filesystem paths, an attacker can break container isolation, access host binaries, and retrieve sensitive host credentials or configuration files. This rule is designed for the Elastic Defend for Containers integration and monitors for both direct chroot execution and shell-based invocation.

Impact

Successful exploitation may allow an attacker to escape container isolation and gain unauthorized access to the underlying host system, including access to host credentials, system binaries, and runtime sockets.

Recommendation

• Deploy the provided EQL rule to identify anomalous chroot execution within container environments.
• Prioritize triage for containers that are running in privileged mode, have host namespaces exposed, or possess mount points targeting /proc/1/root or /host.
• Review container images and deployment manifests to ensure that administrative utilities like chroot are not included or permitted in production container runtimes.
• Harden container configurations by enforcing non-root execution, dropping unnecessary Linux capabilities, and applying security profiles such as AppArmor, SELinux, or seccomp.