Techniques › T1611
T1611 Escape to Host
privilege escalation — Windows, Linux, Containers, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
2
Sigma rules tagged attack.t1611
3
KEV CVEs mapped here
<p>Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.</p><p>There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as
unshare and keyctl to escalate privileges and steal secrets.</p><p>Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as docker.sock, to break out of the container via a Container Administration Command. Adversaries may also escape via Exploitation for Privilege Escalation, such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.</p><p>In ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.</p><p>Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-22226 | VMware ESXi, Workstation, and Fusion | secondary impact | Mapped | 2025-03-04 |
| CVE-2025-22225 | VMware ESXi | primary impact | Mapped | 2025-03-04 |
| CVE-2025-22224 | VMware ESXi and Workstation | primary impact | Mapped | 2025-03-04 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0219 Detection Strategy for Escape to Host v1.0
AN0612 ContainersDetection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.docker:daemon
container create/start with privileged flag or host volume mount→ DC0072 Container Creationkubernetes:apiserverPod spec with hostPath or privileged securityContext→ DC0092 Volume ModificationTunable:AllowedHostPathsPrivilegedContainerThresholdAN0613 LinuxDetection of Linux container escape attempts via syscalls (unshare,keyctl,mount) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.auditd:SYSCALLunshare, mount, keyctl, setns syscalls executed by containerized processes→ DC0021 OS API Executionlinux:Sysmonprocess creation events linked to container namespaces executing host-level binaries→ DC0032 Process CreationTunable:SyscallWhitelistTimeWindowAN0614 WindowsDetection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.Tunable:RestrictedHostDirsAN0615 ESXiDetection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.esxi:vmkernelVM exit/entry anomalies, unexpected hypercalls, or kernel module loading→ DC0031 Kernel Module LoadTunable:AllowedKernelModules
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1611
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · 402b955c-8fe0-4a8c-b635-622b4ac5f902
Detects creation of a container with a hostPath mount.
A hostPath volume mounts a directory or a file from the node to the container.
Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · c5cd1b20-36bb-488d-8c05-486be3d0cb97
Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks.
A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields