Kubernetes nsenter container escape

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	7 Days
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Escape to Host (T1611)
Severity	Informational

The nsenter command was used to execute a process in the context of the initialization process.

Attackers may break out of a container to run commands on the host.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.

The nsenter command was used to execute a process in the context of the initialization process.

Attackers may break out of a container to run commands on the host.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.

The nsenter command was used to execute a process in the context of the initialization process.

Attackers may break out of a container to run commands on the host.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.