Elastic high stable kql

Chroot Execution in Container Context on Linux

Detects chroot execution on Linux when the process appears to run in a container-oriented context: the process title matches runc init, the entry leader is a container workload, or the parent process is runc. Chroot from inside a container can pivot to an alternate root filesystem and is a common step in container breakout attempts when combined with sensitive host mounts.

View Source

Detection Logic

host.os.type:linux and event.category:process and 
event.type:start and event.action:(executed or exec) and 
(process.name:"chroot" or process.args:("chroot" or "/bin/chroot" or "/usr/bin/chroot" or "/usr/local/bin/chroot")) and 
(process.title:"runc init" or process.entry_leader.entry_meta.type:"container" or process.parent.name:("runc" or "containerd-shim-runc-v2")) and
not process.args:(apt-get or add-apt-repository or apt-cache* or */var/lib/rancher/agent/tmp* or dpkg)

False Positives

⚠ Build and packaging images sometimes run chroot against a staged root filesystem inside CI or init containers; correlate with approved pipelines and image build jobs before escalating.

Field Validations

Loading…

Comments (0)

Loading comments...