Falco high stable other

Detect release_agent File Container Escapes

Detect an attempt to exploit a container escape using release_agent file. By running a container with certains capabilities, a privileged user can modify release_agent file and escape from the container.

View Source

Detection Logic

open_write and container and fd.name endswith release_agent and (user.uid=0 or thread.cap_effective contains CAP_DAC_OVERRIDE) and thread.cap_effective contains CAP_SYS_ADMIN

Field Validations

Loading…

Comments (0)

Loading comments...