T1611 Escape to Host

Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)

There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as unshare and keyctl to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)

Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as docker.sock, to break out of the container via a Container Administration Command.(Citation: Container Escape) Adversaries may also escape via Exploitation for Privilege Escalation, such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)

Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers running on the host, or setting up a command and control channel on the host.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.02 Privileged system access Mitigates T1611 Escape to Host
Comments
This diagnostic statement protects against Escape to Host through the use of privileged account management and the use of multi-factor authentication.
References
    PR.PS-01.09 Virtualized end point protection Mitigates T1611 Escape to Host
    Comments
    The diagnostic statement highlights several mechanisms that organizations can implement to protect endpoint systems using virtualization technologies. Virtualization technologies provide a layer of isolation and containment to isolate and contain the impact of potential compromises. For the Escape to Host technique, Consider utilizing seccomp, seccomp-bpf, or a similar solution that restricts certain system calls such as mount. In Kubernetes environments, consider defining Pod Security Standards that limit container access to host process namespaces, the host network, and the host file system.
    References
      PR.PS-01.09 Virtualized end point protection Mitigates T1611 Escape to Host
      Comments
      The diagnostic statement highlights several mechanisms that organizations can implement to protect endpoint systems using virtualization technologies. Virtualization technologies provide a layer of isolation and containment to isolate and contain the impact of potential compromises. For the Escape to Host technique, consider utilizing solutions that restricts certain system calls such as mount from the virtualized machine to the host. In Kubernetes environments, consider defining Pod Security Standards that limit container access to host process namespaces, the host network, and the host file system.
      References
        PR.IR-01.05 Remote access protection Mitigates T1611 Escape to Host
        Comments
        This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
        References
          PR.IR-01.06 Production environment segregation Mitigates T1611 Escape to Host
          Comments
          This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
          References

            NIST 800-53 Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            CM-06 Configuration Settings mitigates T1611 Escape to Host
            CM-05 Access Restrictions for Change mitigates T1611 Escape to Host
            SC-02 Separation of System and User Functionality mitigates T1611 Escape to Host
            SC-03 Security Function Isolation mitigates T1611 Escape to Host
            SC-34 Non-modifiable Executable Programs mitigates T1611 Escape to Host
            SC-39 Process Isolation mitigates T1611 Escape to Host
            SI-16 Memory Protection mitigates T1611 Escape to Host
            SI-02 Flaw Remediation mitigates T1611 Escape to Host
            SI-03 Malicious Code Protection mitigates T1611 Escape to Host
            SI-07 Software, Firmware, and Information Integrity mitigates T1611 Escape to Host
            IA-02 Identification and Authentication (Organizational Users) mitigates T1611 Escape to Host
            CM-07 Least Functionality mitigates T1611 Escape to Host
            SI-04 System Monitoring mitigates T1611 Escape to Host
            AC-02 Account Management mitigates T1611 Escape to Host
            AC-03 Access Enforcement mitigates T1611 Escape to Host
            AC-04 Information Flow Enforcement mitigates T1611 Escape to Host
            AC-05 Separation of Duties mitigates T1611 Escape to Host
            AC-06 Least Privilege mitigates T1611 Escape to Host
            SC-07 Boundary Protection mitigates T1611 Escape to Host

            VERIS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            action.hacking.variety.Virtual machine escape Virtual machine escape. Child of 'Exploit vuln'. related-to T1611 Escape to Host

            Azure Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            defender_for_containers Microsoft Defender for Containers technique_scores T1611 Escape to Host
            Comments
            This capability can detect escape to host.
            References
            defender_for_containers Microsoft Defender for Containers technique_scores T1611 Escape to Host
            Comments
            This capability can protect against escape to host attacks.
            References

            GCP Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            gke_enterprise GKE Enterprise technique_scores T1611 Escape to Host
            Comments
            GKE Enterprise incorporates the Anthos Config Management feature to create and manage Kubernetes objects across multiple clusters at once. PodSecurityPolicies can be enforced to prevent Pods from using the root Linux user and prevents pods from running privileged containers. This control can be used to limit container access to host process namespaces, the host network, and the host file system, which may enable adversaries to break out of containers and gain access to the underlying host.
            References
            google_kubernetes_engine Google Kubernetes Engine technique_scores T1611 Escape to Host
            Comments
            By default, GKE nodes use Google's Container-Optimized OS to enhance the security of GKE clusters, including: Read-only filesystem, limited user accounts, and disabled root login.
            References
            google_kubernetes_engine Google Kubernetes Engine technique_scores T1611 Escape to Host
            Comments
            GKE provides the ability to audit against a Center for Internet Security (CIS) Benchmark which is a set of recommendations for configuring Kubernetes to support a strong security posture. The Benchmark is tied to a specific Kubernetes release.
            References

            AWS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            aws_config AWS Config technique_scores T1611 Escape to Host
            Comments
            The "ecs-task-definition-user-for-host-mode-check" managed rule can identify Amazon Elastic Container Service (ECS) task definitions for containers with host networking mode and 'privileged' or 'user' container definitions, which may enable adversaries to break out of containers and gain access to the underlying host. It is run on configuration changes. Coverage is partial, since adversaries may find other means to escape a container to the underlying host, resulting in an overall score of Partial.
            References