Product
Chroot Execution in Container Context on Linux
1 rule 1 TTPAn Elastic detection rule targets `chroot` execution on Linux systems in a containerized context, often indicative of container breakout attempts to achieve privilege escalation by pivoting to an alternate root filesystem, typically leveraging sensitive host mounts.
Google Cloud Platform (GKE containerd): Multiple Vulnerabilities
3 rules 5 TTPsAn authenticated remote attacker can exploit multiple vulnerabilities in Google Cloud Platform, specifically within GKE containerd, to achieve arbitrary code execution, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
Containerd runAsNonRoot Bypass via Crafted User Directive (CVE-2026-46680)
2 rules 1 TTP 1 CVEA vulnerability in containerd allows for bypassing the Kubernetes `runAsNonRoot` restriction by exploiting a misinterpretation of large numeric User directives in container images, potentially leading to container execution as root (UID 0); this is tracked as CVE-2026-46680 and CVE-2024-40635.
Containerd runAsNonRoot Bypass via Crafted User Directive (CVE-2026-46680)
2 rules 1 TTP 1 CVEA vulnerability in containerd allows for bypassing the Kubernetes `runAsNonRoot` restriction by exploiting a misinterpretation of large numeric User directives in container images, potentially leading to container execution as root (UID 0); this is tracked as CVE-2026-46680 and CVE-2024-40635.
Unusual Process Connecting to Docker or Containerd Socket
2 rules 3 TTPsAn unusual process connecting to a container runtime Unix socket like Docker or Containerd can indicate an attacker attempting to bypass Kubernetes security measures for container manipulation.