Potential Container Escape via Modified release_agent File

 1[metadata]
 2creation_date = "2023/10/26"
 3integration = ["cloud_defend"]
 4maturity = "production"
 5min_stack_comments = "New Integration: Cloud Defend"
 6min_stack_version = "8.8.0"
 7updated_date = "2023/12/14"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12This rule detects modification of the CGroup release_agent file from inside a privileged container. The release_agent is
13a script that is executed at the termination of any process on that CGroup and is invoked from the host. A privileged
14container with SYS_ADMIN capabilities, enables a threat actor to mount a CGroup directory and modify the release_agent
15which could be used for further privilege escalation and container escapes to the host machine.
16"""
17from = "now-6m"
18index = ["logs-cloud_defend*"]
19interval = "5m"
20language = "eql"
21license = "Elastic License v2"
22name = "Potential Container Escape via Modified release_agent File"
23references = [
24    "https://blog.aquasec.com/threat-alert-container-escape",
25    "https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/",
26    "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#privileged-escape-abusing-existent-release_agent-cve-2022-0492-poc1",
27]
28risk_score = 47
29rule_id = "160896de-b66f-42cb-8fef-20f53a9006ea"
30severity = "medium"
31tags = [
32    "Data Source: Elastic Defend for Containers",
33    "Domain: Container",
34    "OS: Linux",
35    "Use Case: Threat Detection",
36    "Tactic: Privilege Escalation",
37]
38timestamp_override = "event.ingested"
39type = "eql"
40
41query = '''
42file where event.module == "cloud_defend" and event.action == "open" and 
43event.type == "change" and file.name : "release_agent"
44'''
45
46
47[[rule.threat]]
48framework = "MITRE ATT&CK"
49[[rule.threat.technique]]
50id = "T1611"
51name = "Escape to Host"
52reference = "https://attack.mitre.org/techniques/T1611/"
53
54
55[rule.threat.tactic]
56id = "TA0004"
57name = "Privilege Escalation"
58reference = "https://attack.mitre.org/tactics/TA0004/"

References

• Threat Alert: Threat Actors Using release_agent Container Escape

  

  Team Nautilus detected a crypto mining campaign that uses a container escape technique to break out from the container and compromise the host

  
  Read More

• CVE-2022-0492: Privilege escalation vulnerability causing container escape

  

  Linux maintainers disclosed a privilege escalation vulnerability (CVE-2022-0492) in the Linux Kernel rated as a High severity.

  
  Read More

• Docker Breakout / Privilege Escalation | HackTricks | HackTricks

  

  Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)! Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Acces...

  
  Read More

Related rules

• AWS Credentials Searched For Inside A Container
• Container Management Utility Run Inside A Container
• File Made Executable via Chmod Inside A Container
• Interactive Exec Command Launched Against A Running Container
• Netcat Listener Established Inside A Container