破笼寻踪
原名：detecting-container-escape-attempts
检测容器逃逸尝试，通过监控命名空间操作、权限滥用、内核漏洞利用、敏感挂载路径及异常系统调用，使用 Falco、Sysdig 和 seccomp/audit 规则。适用于排查容器工作负载提权或调查 Docker/Kubernetes 环境中的疑似逃逸事件。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-09-07
- TRACE 评分
- 3 / 5
内容概览
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators such as namespace manipulation, capability abuse, kernel exploits, mounted sensitive paths, and anomalous syscall patterns using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules. - When investigating security incidents that require detecting container escape attempts - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Linux host with kernel 5.10+ (eBPF support) - Falco 0.37+ installed (kernel module or eBPF probe) - Docker Engine or containerd runtime - auditd configured - Root access for eBPF/kerne…