Tag
Potential Chroot Container Escape via Mount
2 rulesThe rule detects a potential chroot container escape via mount, which involves a user within a container mounting the host's root file system and using chroot to escape the containerized environment, indicating a privilege escalation attempt.
Chroot Execution in Container Context on Linux
2 rules 1 TTPDetects suspicious chroot execution within a Linux container context, potentially indicating a container escape attempt by pivoting to an alternate root filesystem.
LXD Backup Import Bypass Allows Privilege Escalation in Restricted Projects
2 rules 1 TTPA vulnerability in LXD allows an attacker with instance-creation rights in a restricted project to bypass project restrictions and escalate privileges by crafting a malicious backup archive.
Kata Containers CopyFile Policy Subversion via Symlinks
3 rules 2 TTPs 1 CVEAn oversight in the CopyFile policy in Kata Containers allows untrusted hosts to write to arbitrary locations inside the guest workload image via symlinks, enabling binary overwrites and data exfiltration.
Suspicious Unshare Usage for Namespace Manipulation
2 rules 2 TTPsThe `unshare` command is used to create new namespaces in Linux, which can be exploited to break out of containers or elevate privileges by creating namespaces that bypass security controls.
Suspicious Unshare Usage for Container Escape and Privilege Escalation
2 rules 2 TTPsThe rule identifies suspicious usage of unshare to manipulate system namespaces, which can be utilized to escalate privileges or escape container security boundaries.