THREATNOIR
Subscribe
MITRE ATT&CK · T1611

Escape to Host

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers break out of a container or virtualised environment to gain access to the underlying host, and from there to other containers or the wider environment. This serves the Privilege Escalation tactic.

How to defend. Do not run containers as privileged or as root, avoid mounting sensitive host paths or the container runtime socket, and apply security profiles such as seccomp and AppArmor or SELinux. Keep container runtimes and host kernels patched, and use admission control in orchestration platforms to enforce these rules.

Signs to look for. Look for containers started with privileged flags or host mounts, processes in containers accessing host namespaces, and kernel exploit behaviour. A common gap is lack of runtime monitoring inside container platforms.

Open the technique on MITRE ATT&CK
The official text
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment. There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets. Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a Container Administration Command. Adversaries may also escape via Exploitation for Privilege Escalation, such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.