Docker Release File Creation

 1[metadata]
 2creation_date = "2025/04/25"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2025/04/25"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects the creation of files named release_agent or notify_on_release, which are
11commonly associated with the abuse of Linux cgroup release mechanisms. In Docker or containerized
12environments, this behavior may indicate an attempt to exploit privilege escalation vulnerabilities
13such as CVE-2022-0492, where attackers use the release_agent feature to execute code on the host
14from within a container.
15"""
16from = "now-9m"
17index = ["logs-endpoint.events.file*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Docker Release File Creation"
21references = ["https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/"]
22risk_score = 21
23rule_id = "4d4cda2b-9aad-4702-a0a2-75952bd6a77c"
24severity = "low"
25tags = [
26    "Domain: Endpoint",
27    "Domain: Container",
28    "OS: Linux",
29    "Use Case: Threat Detection",
30    "Tactic: Privilege Escalation",
31    "Data Source: Elastic Defend",
32]
33timestamp_override = "event.ingested"
34type = "eql"
35query = '''
36file where host.os.type == "linux" and event.type == "creation" and file.name in ("release_agent", "notify_on_release")
37'''
38
39[[rule.threat]]
40framework = "MITRE ATT&CK"
41
42[[rule.threat.technique]]
43id = "T1611"
44name = "Escape to Host"
45reference = "https://attack.mitre.org/techniques/T1611/"
46
47[rule.threat.tactic]
48id = "TA0004"
49name = "Privilege Escalation"
50reference = "https://attack.mitre.org/tactics/TA0004/"