Analytics
Medium
✕
A contained process attempted to escape using the 'notify on release' feature
A contained process attempted to escape the host by leveraging the Docker's 'notify on release' feature. The calling process modified relevant files that might trigger a command on the host.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Escape to Host (T1611)
Attacker's goals:
Execute arbitrary commands on the host and gain a larger foothold.
Investigative actions:
Check which commands were executed on the host afterward. Look for the root cause of the execution within the container. Examine the release_agent script content on the container.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
1 variation:
- A contained process attempted to escape using the 'notify on release' feature Medium