Runc

An Elastic detection rule targets `chroot` execution on Linux systems in a containerized context, often indicative of container breakout attempts to achieve privilege escalation by pivoting to an alternate root filesystem, typically leveraging sensitive host mounts.

This brief details how attackers may leverage the `systemd-run` utility on Linux systems for defense evasion and execution by running commands as detached, transient services or scopes to obscure their activities and parent-child process chains.