{"id":"T1611","name":"Escape to Host","url":"https://attack.mitre.org/techniques/T1611","tactics":["privilege-escalation"],"platforms":["Windows","Linux","Containers","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0219","stix_id":"x-mitre-detection-strategy--8796c5cc-7e5a-402f-8252-f083aafc5cc9","name":"Detection Strategy for Escape to Host","url":"https://attack.mitre.org/detectionstrategies/DET0219","analytics":[{"id":"AN0612","stix_id":"x-mitre-analytic--fc9161ef-3cab-45f5-a585-d78778d72f2b","name":"Analytic 0612","description":"Detection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0612","platforms":["Containers"],"log_source_references":[{"name":"docker:daemon","channel":"container create/start with privileged flag or host volume mount","data_component":"DC0072","data_component_name":"Container Creation","log_source_slug":"docker-daemon"},{"name":"kubernetes:apiserver","channel":"Pod spec with hostPath or privileged securityContext","data_component":"DC0092","data_component_name":"Volume Modification","log_source_slug":"kubernetes-apiserver"}],"mutable_elements":[{"field":"AllowedHostPaths","description":"List of directories permitted for hostPath volumes. Any access beyond these paths may be suspicious."},{"field":"PrivilegedContainerThreshold","description":"Number of privileged container launches expected in the environment. Exceeding this may indicate adversary behavior."}],"live":true,"detection_strategies":["DET0219"],"techniques":["T1611"]},{"id":"AN0613","stix_id":"x-mitre-analytic--0021ecae-778a-4726-aa66-1cf4ca01943e","name":"Analytic 0613","description":"Detection of Linux container escape attempts via syscalls (`unshare`, `keyctl`, `mount`) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0613","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"unshare, mount, keyctl, setns syscalls executed by containerized processes","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"auditd-syscall"},{"name":"linux:Sysmon","channel":"process creation events linked to container namespaces executing host-level binaries","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"linux-sysmon"}],"mutable_elements":[{"field":"SyscallWhitelist","description":"Expected syscalls by containerized workloads. Deviations may signal an escape attempt."},{"field":"TimeWindow","description":"Defines correlation window (e.g., 60s) between suspicious syscalls and follow-on host process activity."}],"live":true,"detection_strategies":["DET0219"],"techniques":["T1611"]},{"id":"AN0614","stix_id":"x-mitre-analytic--81e2b983-2159-47d1-9ec1-a5c863faa1a7","name":"Analytic 0614","description":"Detection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0614","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"RestrictedHostDirs","description":"Critical system paths containers should not access (e.g., C:\\Windows, C:\\ProgramData)."}],"live":true,"detection_strategies":["DET0219"],"techniques":["T1611"]},{"id":"AN0615","stix_id":"x-mitre-analytic--9f5f193f-6aef-4586-a047-492b0c651001","name":"Analytic 0615","description":"Detection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.","url":"https://attack.mitre.org/detectionstrategies/DET0219#AN0615","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"VM exit/entry anomalies, unexpected hypercalls, or kernel module loading","data_component":"DC0031","data_component_name":"Kernel Module Load","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"AllowedKernelModules","description":"Modules permitted in the hypervisor. Loading any module outside of this list may indicate compromise."}],"live":true,"detection_strategies":["DET0219"],"techniques":["T1611"]}],"live":true,"version":"1.0","techniques":["T1611"]}],"sigma_rules":[{"id":"402b955c-8fe0-4a8c-b635-622b4ac5f902","title":"Container With A hostPath Mount Created","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":null,"description":"Detects creation of a container with a hostPath mount.\nA hostPath volume mounts a directory or a file from the node to the container.\nAttackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.\n","references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/","https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1611","attack.privilege-escalation"],"path":"rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml","techniques":["T1611"],"cves":[]},{"id":"c5cd1b20-36bb-488d-8c05-486be3d0cb97","title":"Privileged Container Deployed","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":null,"description":"Detects the creation of a \"privileged\" container, an action which could be indicative of a threat actor mounting a container breakout attacks.\nA privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.\nVarious versions of \"privileged\" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields\n","references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/","https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer","https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html","https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1611","attack.privilege-escalation"],"path":"rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml","techniques":["T1611"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-22226","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-22225","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-22224","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}