Elastic medium stable kql
Privileged Docker Container Creation
This rule leverages the new_terms rule type to identify the creation of a potentially unsafe docker container from an unusual parent process. Attackers can use the "--privileged" flag to create containers with escalated privileges, which can lead to trivial privilege escalation, docker escaping and persistence. access.
Detection Logic
host.os.type:linux and event.category:process and event.type:start and
event.action:(exec or exec_event or start) and
process.name:docker and process.args:(run and --privileged)Field Validations
Loading…
Comments (0)
Loading comments...