[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CMHPWV5RJZ9DRM7FASM9G":3,"skill-same:01M71CMHPWV5RJZ9DRM7FASM9G":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":6,"ownerHtmlUrl":81,"ownerBlogUrl":6,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M71CMHPWV5RJZ9DRM7FASM9G","kubernetes-runtime-container-analyze",null,"Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Fcontainer\u002Fanalyze\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"kubernetes runtime container analyze","runtime","container","analyze","kubernetes","stack","container escape","de","host","critical","cm","access","Bash","analysis","escape-detection","runtime-security","monitoring","verification","code","cybersecurity","2026-11-10 10:12:30",false,"---\nname: kubernetes-runtime-container-analyze\ndescription: Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- kubernetes\n- docker\n- security\n- runtime-security\n- escape-detection\nd3fend_techniques:\n- Platform Monitoring\n- Process Code Segment Verification\n- Stack Frame Canary Validation\n- Segment Address Offset Randomization\n- Process Analysis\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1610\ncve:\n- CVE-2022-0185\ncapec: []\n---\n\n# Detecting Container Escape Attempts\n\n## Overview\n\nContainer escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp\u002Faudit rules.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container escape attempts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Linux host with kernel 5.10+ (eBPF support)\n- Falco 0.37+ installed (kernel module or eBPF probe)\n- Docker Engine or containerd runtime\n- auditd configured\n- Root access for eBPF\u002Fkernel module loading\n\n## Core Concepts\n\n### Common Container Escape Vectors\n\n| Vector | Technique | MITRE ID |\n|--------|-----------|----------|\n| Privileged containers | Mount host filesystem, load kernel modules | T1611 |\n| Docker socket mount | Create privileged container from within | T1610 |\n| Kernel exploits | CVE-2022-0185 (fsconfig), Dirty Pipe, runc CVEs | T1068 |\n| Capability abuse | CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN | T1548 |\n| Sensitive mounts | \u002Fproc\u002Fsysrq-trigger, \u002Fproc\u002Fkcore, cgroup release_agent | T1611 |\n| Namespace escape | nsenter, unshare to host namespaces | T1611 |\n| Symlink\u002Fbind mount | Escape through \u002Fproc\u002Fself\u002Froot | T1611 |\n\n### Detection Layers\n\n1. **Syscall monitoring** - eBPF\u002Fkernel module captures syscalls in real-time\n2. **File integrity** - Detect modification of escape-enabling paths\n3. **Process monitoring** - Track process creation, namespace changes\n4. **Network monitoring** - Detect container-to-host connections\n5. **Audit logging** - Linux auditd for capability and mount operations\n\n## Workflow\n\n### Step 1: Deploy Falco for Runtime Detection\n\n```yaml\n# falco-values.yaml for Helm deployment\nfalco:\n  driver:\n    kind: ebpf   # or modern_ebpf for kernel 5.8+\n  rules_files:\n    - \u002Fetc\u002Ffalco\u002Ffalco_rules.yaml\n    - \u002Fetc\u002Ffalco\u002Ffalco_rules.local.yaml\n    - \u002Fetc\u002Ffalco\u002Frules.d\n  json_output: true\n  json_include_output_property: true\n  http_output:\n    enabled: true\n    url: \"http:\u002F\u002Ffalcosidekick:2801\"\n  grpc:\n    enabled: true\n  priority: warning\n```\n\n```bash\n# Install Falco via Helm\nhelm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\nhelm install falco falcosecurity\u002Ffalco \\\n  --namespace falco-system --create-namespace \\\n  -f falco-values.yaml\n```\n\n### Step 2: Custom Falco Rules for Escape Detection\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer_escape.yaml\n\n# Detect container escape via privileged container\n- rule: Container Escape via Privileged Mode\n  desc: Detect attempts to escape container using privileged capabilities\n  condition: >\n    spawned_process and container and\n    (proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or\n     (proc.name = chroot and proc.args contains \"\u002Fhost\"))\n  output: >\n    Container escape attempt via privileged operation\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline pid=%proc.pid %container.info)\n  priority: CRITICAL\n  tags: [container, escape, T1611]\n\n# Detect Docker socket access from container\n- rule: Container Access to Docker Socket\n  desc: Detect container reading\u002Fwriting to Docker socket\n  condition: >\n    (open_read or open_write) and container and\n    fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Docker socket accessed from container\n    (user=%user.name container=%container.name image=%container.image.repository\n     fd=%fd.name command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, docker_socket]\n\n# Detect sensitive proc filesystem access\n- rule: Container Access to Sensitive Proc Paths\n  desc: Detect container accessing host-sensitive proc paths\n  condition: >\n    open_read and container and\n    (fd.name startswith \u002Fproc\u002Fsysrq-trigger or\n     fd.name startswith \u002Fproc\u002Fkcore or\n     fd.name startswith \u002Fproc\u002Fkmsg or\n     fd.name startswith \u002Fproc\u002Fkallsyms or\n     fd.name startswith \u002Fsys\u002Fkernel)\n  output: >\n    Sensitive proc\u002Fsys access from container\n    (user=%user.name container=%container.name path=%fd.name\n     command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, proc_access]\n\n# Detect cgroup escape technique\n- rule: Container Cgroup Escape Attempt\n  desc: Detect writing to cgroup release_agent (escape technique)\n  condition: >\n    open_write and container and\n    (fd.name contains release_agent or\n     fd.name contains notify_on_release)\n  output: >\n    Cgroup escape attempt detected\n    (user=%user.name container=%container.name path=%fd.name\n     command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, cgroup]\n\n# Detect kernel module loading from container\n- rule: Container Loading Kernel Module\n  desc: Detect container attempting to load kernel modules\n  condition: >\n    spawned_process and container and\n    (proc.name in (modprobe, insmod, rmmod) or\n     (evt.type = init_module or evt.type = finit_module))\n  output: >\n    Kernel module load attempt from container\n    (user=%user.name container=%container.name command=%proc.cmdline\n     %container.info)\n  priority: CRITICAL\n  tags: [container, escape, kernel_module]\n\n# Detect namespace manipulation\n- rule: Container Namespace Manipulation\n  desc: Detect setns\u002Funshare syscalls from container\n  condition: >\n    container and (evt.type = setns or evt.type = unshare) and\n    not proc.name in (containerd-shim, runc)\n  output: >\n    Namespace manipulation from container\n    (user=%user.name container=%container.name syscall=%evt.type\n     command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, namespace]\n\n# Detect mount operations from container\n- rule: Container Mount Sensitive Filesystem\n  desc: Detect container mounting host filesystems\n  condition: >\n    spawned_process and container and proc.name = mount and\n    (proc.args contains \"\u002Fdev\u002F\" or proc.args contains \"proc\" or\n     proc.args contains \"sysfs\")\n  output: >\n    Sensitive mount operation from container\n    (user=%user.name container=%container.name command=%proc.cmdline\n     %container.info)\n  priority: HIGH\n  tags: [container, escape, mount]\n```\n\n### Step 3: Configure Seccomp Profile for Escape Prevention\n\n```json\n{\n  \"defaultAction\": \"SCMP_ACT_ERRNO\",\n  \"archMap\": [\n    { \"architecture\": \"SCMP_ARCH_X86_64\", \"subArchitectures\": [\"SCMP_ARCH_X86\", \"SCMP_ARCH_X32\"] }\n  ],\n  \"syscalls\": [\n    {\n      \"names\": [\n        \"read\", \"write\", \"open\", \"close\", \"stat\", \"fstat\", \"lstat\",\n        \"poll\", \"lseek\", \"mmap\", \"mprotect\", \"munmap\", \"brk\",\n        \"rt_sigaction\", \"rt_sigprocmask\", \"ioctl\", \"access\",\n        \"pipe\", \"select\", \"sched_yield\", \"dup\", \"dup2\",\n        \"nanosleep\", \"getpid\", \"socket\", \"connect\", \"accept\",\n        \"sendto\", \"recvfrom\", \"bind\", \"listen\", \"getsockname\",\n        \"getpeername\", \"socketpair\", \"setsockopt\", \"getsockopt\",\n        \"clone\", \"fork\", \"vfork\", \"execve\", \"exit\", \"wait4\",\n        \"kill\", \"getuid\", \"getgid\", \"geteuid\", \"getegid\",\n        \"epoll_create\", \"epoll_wait\", \"epoll_ctl\", \"epoll_create1\",\n        \"futex\", \"set_tid_address\", \"set_robust_list\",\n        \"openat\", \"newfstatat\", \"readlinkat\", \"fchownat\",\n        \"clock_gettime\", \"clock_getres\", \"clock_nanosleep\",\n        \"getrandom\", \"memfd_create\", \"statx\", \"rseq\"\n      ],\n      \"action\": \"SCMP_ACT_ALLOW\"\n    },\n    {\n      \"names\": [\"unshare\", \"setns\", \"mount\", \"umount2\", \"pivot_root\",\n                \"init_module\", \"finit_module\", \"delete_module\",\n                \"kexec_load\", \"kexec_file_load\", \"ptrace\",\n                \"reboot\", \"swapon\", \"swapoff\", \"sethostname\",\n                \"setdomainname\", \"keyctl\", \"bpf\"],\n      \"action\": \"SCMP_ACT_LOG\",\n      \"comment\": \"Log escape-relevant syscalls for detection\"\n    }\n  ]\n}\n```\n\n### Step 4: Audit Rules for Container Escape\n\n```bash\n# \u002Fetc\u002Faudit\u002Frules.d\u002Fcontainer-escape.rules\n\n# Monitor namespace operations\n-a always,exit -F arch=b64 -S setns -S unshare -k container_escape\n-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount\n-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_module\n-a always,exit -F arch=b64 -S ptrace -k process_trace\n\n# Monitor sensitive paths\n-w \u002Fvar\u002Frun\u002Fdocker.sock -p rwxa -k docker_socket\n-w \u002Fproc\u002Fsysrq-trigger -p w -k sysrq\n-w \u002Fproc\u002Fkcore -p r -k kcore_read\n\n# Monitor container runtime\n-w \u002Fusr\u002Fbin\u002Frunc -p x -k container_runtime\n-w \u002Fusr\u002Fbin\u002Fcontainerd -p x -k container_runtime\n-w \u002Fusr\u002Fbin\u002Fdocker -p x -k container_runtime\n```\n\n### Step 5: Real-Time Alert Pipeline\n\n```yaml\n# Falcosidekick configuration for alert routing\nconfig:\n  slack:\n    webhookurl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002Fxxx\"\n    minimumpriority: \"critical\"\n    messageformat: |\n      *Container Escape Alert*\n      Rule: {{ .Rule }}\n      Priority: {{ .Priority }}\n      Output: {{ .Output }}\n\n  elasticsearch:\n    hostport: \"https:\u002F\u002Felasticsearch:9200\"\n    index: \"falco-alerts\"\n    minimumpriority: \"warning\"\n\n  pagerduty:\n    routingkey: \"xxxx\"\n    minimumpriority: \"critical\"\n```\n\n## Validation Commands\n\n```bash\n# Test Falco rules with event generator\nkubectl run falco-event-generator \\\n  --image=falcosecurity\u002Fevent-generator \\\n  --restart=Never \\\n  -- run syscall --action PtraceAttachContainer\n\n# Check Falco alerts\nkubectl logs -n falco-system -l app.kubernetes.io\u002Fname=falco --tail=50\n\n# Verify seccomp profile is loaded\ndocker inspect --format '{{.HostConfig.SecurityOpt}}' \u003Ccontainer-id>\n\n# Check audit logs for escape-related events\nausearch -k container_escape --interpret\n```\n\n## References\n\n- [Falco Runtime Security](https:\u002F\u002Ffalco.org\u002Fdocs\u002F)\n- [Container Escape Techniques - HackTricks](https:\u002F\u002Fbook.hacktricks.xyz\u002Flinux-hardening\u002Fprivilege-escalation\u002Fdocker-security\u002Fdocker-breakout-privilege-escalation)\n- [MITRE ATT&CK T1611 - Escape to Host](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1611\u002F)\n- [Sysdig Container Security](https:\u002F\u002Fsysdig.com\u002Fproducts\u002Fsecure\u002F)\n","# Detecting Container Escape Attempts\n\n## Overview\n\nContainer escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp\u002Faudit rules.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container escape attempts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Linux host with kernel 5.10+ (eBPF support)\n- Falco 0.37+ installed (kernel module or eBPF probe)\n- Docker Engine or containerd runtime\n- auditd configured\n- Root access for eBPF\u002Fkernel module loading\n\n## Core Concepts\n\n### Common Container Escape Vectors\n\n| Vector | Technique | MITRE ID |\n|--------|-----------|----------|\n| Privileged containers | Mount host filesystem, load kernel modules | T1611 |\n| Docker socket mount | Create privileged container from within | T1610 |\n| Kernel exploits | CVE-2022-0185 (fsconfig), Dirty Pipe, runc CVEs | T1068 |\n| Capability abuse | CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN | T1548 |\n| Sensitive mounts | \u002Fproc\u002Fsysrq-trigger, \u002Fproc\u002Fkcore, cgroup release_agent | T1611 |\n| Namespace escape | nsenter, unshare to host namespaces | T1611 |\n| Symlink\u002Fbind mount | Escape through \u002Fproc\u002Fself\u002Froot | T1611 |\n\n### Detection Layers\n\n1. **Syscall monitoring** - eBPF\u002Fkernel module captures syscalls in real-time\n2. **File integrity** - Detect modification of escape-enabling paths\n3. **Process monitoring** - Track process creation, namespace changes\n4. **Network monitoring** - Detect container-to-host connections\n5. **Audit logging** - Linux auditd for capability and mount operations\n\n## Workflow\n\n### Step 1: Deploy Falco for Runtime Detection\n\n```yaml\n# falco-values.yaml for Helm deployment\nfalco:\n  driver:\n    kind: ebpf   # or modern_ebpf for kernel 5.8+\n  rules_files:\n    - \u002Fetc\u002Ffalco\u002Ffalco_rules.yaml\n    - \u002Fetc\u002Ffalco\u002Ffalco_rules.local.yaml\n    - \u002Fetc\u002Ffalco\u002Frules.d\n  json_output: true\n  json_include_output_property: true\n  http_output:\n    enabled: true\n    url: \"http:\u002F\u002Ffalcosidekick:2801\"\n  grpc:\n    enabled: true\n  priority: warning\n```\n\n```bash\n# Install Falco via Helm\nhelm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\nhelm install falco falcosecurity\u002Ffalco \\\n  --namespace falco-system --create-namespace \\\n  -f falco-values.yaml\n```\n\n### Step 2: Custom Falco Rules for Escape Detection\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer_escape.yaml\n\n# Detect container escape via privileged container\n- rule: Container Escape via Privileged Mode\n  desc: Detect attempts to escape container using privileged capabilities\n  condition: >\n    spawned_process and container and\n    (proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or\n     (proc.name = chroot and proc.args contains \"\u002Fhost\"))\n  output: >\n    Container escape attempt via privileged operation\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline pid=%proc.pid %container.info)\n  priority: CRITICAL\n  tags: [container, escape, T1611]\n\n# Detect Docker socket access from container\n- rule: Container Access to Docker Socket\n  desc: Detect container reading\u002Fwriting to Docker socket\n  condition: >\n    (open_read or open_write) and container and\n    fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Docker socket accessed from container\n    (user=%user.name container=%container.name image=%container.image.repository\n     fd=%fd.name command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, docker_socket]\n\n# Detect sensitive proc filesystem access\n- rule: Container Access to Sensitive Proc Paths\n  desc: Detect container accessing host-sensitive proc paths\n  condition: >\n    open_read and container and\n    (fd.name startswith \u002Fproc\u002Fsysrq-trigger or\n     fd.name startswith \u002Fproc\u002Fkcore or\n     fd.name startswith \u002Fproc\u002Fkmsg or\n     fd.name startswith \u002Fproc\u002Fkallsyms or\n     fd.name startswith \u002Fsys\u002Fkernel)\n  output: >\n    Sensitive proc\u002Fsys access from container\n    (user=%user.name container=%container.name path=%fd.name\n     command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, proc_access]\n\n# Detect cgroup escape technique\n- rule: Container Cgroup Escape Attempt\n  desc: Detect writing to cgroup release_agent (escape technique)\n  condition: >\n    open_write and container and\n    (fd.name contains release_agent or\n     fd.name contains notify_on_release)\n  output: >\n    Cgroup escape attempt detected\n    (user=%user.name container=%container.name path=%fd.name\n     command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, cgroup]\n\n# Detect kernel module loading from container\n- rule: Container Loading Kernel Module\n  desc: Detect container attempting to load kernel modules\n  condition: >\n    spawned_process and container and\n    (proc.name in (modprobe, insmod, rmmod) or\n     (evt.type = init_module or evt.type = finit_module))\n  output: >\n    Kernel module load attempt from container\n    (user=%user.name container=%container.name command=%proc.cmdline\n     %container.info)\n  priority: CRITICAL\n  tags: [container, escape, kernel_module]\n\n# Detect namespace manipulation\n- rule: Container Namespace Manipulation\n  desc: Detect setns\u002Funshare syscalls from container\n  condition: >\n    container and (evt.type = setns or evt.type = unshare) and\n    not proc.name in (containerd-shim, runc)\n  output: >\n    Namespace manipulation from container\n    (user=%user.name container=%container.name syscall=%evt.type\n     command=%proc.cmdline %container.info)\n  priority: CRITICAL\n  tags: [container, escape, namespace]\n\n# Detect mount operations from container\n- rule: Container Mount Sensitive Filesystem\n  desc: Detect container mounting host filesystems\n  condition: >\n    spawned_process and container and proc.name = mount and\n    (proc.args contains \"\u002Fdev\u002F\" or proc.args contains \"proc\" or\n     proc.args contains \"sysfs\")\n  output: >\n    Sensitive mount operation from container\n    (user=%user.name container=%container.name command=%proc.cmdline\n     %container.info)\n  priority: HIGH\n  tags: [container, escape, mount]\n```\n\n### Step 3: Configure Seccomp Profile for Escape Prevention\n\n```json\n{\n  \"defaultAction\": \"SCMP_ACT_ERRNO\",\n  \"archMap\": [\n    { \"architecture\": \"SCMP_ARCH_X86_64\", \"subArchitectures\": [\"SCMP_ARCH_X86\", \"SCMP_ARCH_X32\"] }\n  ],\n  \"syscalls\": [\n    {\n      \"names\": [\n        \"read\", \"write\", \"open\", \"close\", \"stat\", \"fstat\", \"lstat\",\n        \"poll\", \"lseek\", \"mmap\", \"mprotect\", \"munmap\", \"brk\",\n        \"rt_sigaction\", \"rt_sigprocmask\", \"ioctl\", \"access\",\n        \"pipe\", \"select\", \"sched_yield\", \"dup\", \"dup2\",\n        \"nanosleep\", \"getpid\", \"socket\", \"connect\", \"accept\",\n        \"sendto\", \"recvfrom\", \"bind\", \"listen\", \"getsockname\",\n        \"getpeername\", \"socketpair\", \"setsockopt\", \"getsockopt\",\n        \"clone\", \"fork\", \"vfork\", \"execve\", \"exit\", \"wait4\",\n        \"kill\", \"getuid\", \"getgid\", \"geteuid\", \"getegid\",\n        \"epoll_create\", \"epoll_wait\", \"epoll_ctl\", \"epoll_create1\",\n        \"futex\", \"set_tid_address\", \"set_robust_list\",\n        \"openat\", \"newfstatat\", \"readlinkat\", \"fchownat\",\n        \"clock_gettime\", \"clock_getres\", \"clock_nanosleep\",\n        \"getrandom\", \"memfd_create\", \"statx\", \"rseq\"\n      ],\n      \"action\": \"SCMP_ACT_ALLOW\"\n    },\n    {\n      \"names\": [\"unshare\", \"setns\", \"mount\", \"umount2\", \"pivot_root\",\n                \"init_module\", \"finit_module\", \"delete_module\",\n                \"kexec_load\", \"kexec_file_load\", \"ptrace\",\n                \"reboot\", \"swapon\", \"swapoff\", \"sethostname\",\n                \"setdomainname\", \"keyctl\", \"bpf\"],\n      \"action\": \"SCMP_ACT_LOG\",\n      \"comment\": \"Log escape-relevant syscalls for detection\"\n    }\n  ]\n}\n```\n\n### Step 4: Audit Rules for Container Escape\n\n```bash\n# \u002Fetc\u002Faudit\u002Frules.d\u002Fcontainer-escape.rules\n\n# Monitor namespace operations\n-a always,exit -F arch=b64 -S setns -S unshare -k container_escape\n-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount\n-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_module\n-a always,exit -F arch=b64 -S ptrace -k process_trace\n\n# Monitor sensitive paths\n-w \u002Fvar\u002Frun\u002Fdocker.sock -p rwxa -k docker_socket\n-w \u002Fproc\u002Fsysrq-trigger -p w -k sysrq\n-w \u002Fproc\u002Fkcore -p r -k kcore_read\n\n# Monitor container runtime\n-w \u002Fusr\u002Fbin\u002Frunc -p x -k container_runtime\n-w \u002Fusr\u002Fbin\u002Fcontainerd -p x -k container_runtime\n-w \u002Fusr\u002Fbin\u002Fdocker -p x -k container_runtime\n```\n\n### Step 5: Real-Time Alert Pipeline\n\n```yaml\n# Falcosidekick configuration for alert routing\nconfig:\n  slack:\n    webhookurl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002Fxxx\"\n    minimumpriority: \"critical\"\n    messageformat: |\n      *Container Escape Alert*\n      Rule: {{ .Rule }}\n      Priority: {{ .Priority }}\n      Output: {{ .Output }}\n\n  elasticsearch:\n    hostport: \"https:\u002F\u002Felasticsearch:9200\"\n    index: \"falco-alerts\"\n    minimumpriority: \"warning\"\n\n  pagerduty:\n    routingkey: \"xxxx\"\n    minimumpriority: \"critical\"\n```\n\n## Validation Commands\n\n```bash\n# Test Falco rules with event generator\nkubectl run falco-event-generator \\\n  --image=falcosecurity\u002Fevent-generator \\\n  --restart=Never \\\n  -- run syscall --action PtraceAttachContainer\n\n# Check Falco alerts\nkubectl logs -n falco-system -l app.kubernetes.io\u002Fname=falco --tail=50\n\n# Verify seccomp profile is loaded\ndocker inspect --format '{{.HostConfig.SecurityOpt}}' \u003Ccontainer-id>\n\n# Check audit logs for escape-related events\nausearch -k container_escape --interpret\n```\n\n## References\n\n- [Falco Runtime Security](https:\u002F\u002Ffalco.org\u002Fdocs\u002F)\n- [Container Escape Techniques - HackTricks](https:\u002F\u002Fbook.hacktricks.xyz\u002Flinux-hardening\u002Fprivilege-escalation\u002Fdocker-security\u002Fdocker-breakout-privilege-escalation)\n- [MITRE ATT&CK T1611 - Escape to Host](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1611\u002F)\n- [Sysdig Container Security](https:\u002F\u002Fsysdig.com\u002Fproducts\u002Fsecure\u002F)\n",{"cve":49,"name":5,"tags":51,"capec":55,"model":56,"tools":57,"domain":43,"maxTurns":61,"nist_csf":62,"subdomain":67,"description":7,"mitre_attack":68,"d3fend_techniques":71},[50],"CVE-2022-0185",[52,28,53,54,39,38],"containers","docker","security",[],"sonnet",[58,36,59,60],"Read","Glob","Grep",20,[63,64,65,66],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01","container-security",[69,70],"T1059","T1610",[72,73,74,75,76],"Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Fcontainer\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-runtime-container-analyze",{"tool":90,"command":91},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-runtime-container-analyze",{"tool":93,"command":94},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-runtime-container-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Fcontainer\u002Fanalyze\u002FSKILL.md",true,[98],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"index.json","REFERENCE","参考文档",718,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Fcontainer\u002Fanalyze\u002Findex.json",[105,128,149,169,191,207],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[112,113,114,115,116,31,34,117,118,119,120,121,122,123,124,125,126,43,127],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[135,112,136,115,137,138,139,43,36,37,140,141,142,143,31,144,145,146,147,148],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[156,157,158,159,160,161,43,36,162,37,27,163,31,146,164,165,166,167,168,56],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[113,176,177,178,179,180,181,34,182,43,127,183,184,185,186,187,188,189,190,31],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[198,199,113,200,178,180,201,34,202,182,43,127,37,203,204,205,206,190,31,117],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[214,113,178,215,201,34,216,217,43,127,218,219,220,221,222,223,31,117,224,225],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]