T1611 — Escape to Host

Tactic: Privilege Escalation · Platforms: Windows, Linux, Containers, ESXi

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should…

Sigma detection rules (4)

T1611 Escape to Host

title: T1611 Escape to Host
id: f20ec781-3beb-47a7-99d9-8206aef530b8
description: 'Detection Strategy for Escape to Host (T1611): container-escape indicators via privileged container runtime invocation and host-filesystem bind mounts, observed through Windows/Sysmon process creation telemetry on the container host (container-internal Linux telemetry such as cron/cgroup abuse is out of scope for this Windows-only baseline). Tune using: RestrictedHostDirs.'
references:
  - https://attack.mitre.org/techniques/T1611
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1611

logsource:
  category: process_creation
  product: windows

detection:
  selection_img:
    Image|endswith:
      - '\docker.exe'
      - '\dockerd.exe'
      - '\containerd.exe'
      - '\containerd-shim-runhcs-v1.exe'
      - '\runhcs.exe'
      - '\ctr.exe'
      - '\crictl.exe'
  selection_escape_flags:
    CommandLine|contains:
      - '--privileged'
      - '--pid=host'
      - '--pid host'
      - '--net=host'
      - '--cap-add=SYS_ADMIN'
      - 'HostProcess'
      - '-v /:/host'
      - '-v \\.\pipe\docker_engine'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_img and selection_escape_flags and not filter_system_account

falsepositives:
  - Legitimate container orchestration/administration tooling launching privileged or host-namespace containers for approved maintenance tasks; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1611 Escape to Host

title: T1611 Escape to Host
id: 8a8cb9b1-4687-48ed-bf19-454a522c479a
description: 'Detection Strategy for Escape to Host. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SyscallWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1611
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1611

logsource:
  category: process_creation
  product: linux

detection:
  selection_nsenter:
    type: EXECVE
    a0|endswith: '/nsenter'
    a1|contains: '--target'
  selection_docker:
    type: EXECVE
    a0|endswith: '/docker'
    a1|contains|all:
      - 'run'
      - '--privileged'
  selection_procroot:
    exe|contains: '/proc/1/root'

  condition: 1 of selection*

falsepositives:
  - Legitimate container debugging by platform engineers using nsenter/docker --privileged for support purposes.

level: critical

T1611 Escape to Host

title: T1611 Escape to Host
id: 05d51a80-7e54-41e9-b980-b55c5077fb63
description: 'Detection Strategy for Escape to Host. (Data Component: Container Creation; baseline tier: fallback.) Tune using: AllowedHostPaths, PrivilegedContainerThreshold.'
references:
  - https://attack.mitre.org/techniques/T1611
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1611

logsource:
  product: docker
  service: daemon

detection:
  selection:
    Type: 'container'
    Action: 'create'
  selection_labels:
    Type: 'container'
    Actor.Attributes.image|contains:
      - 'nsenter'
      - 'docker.sock'
      - 'privileged'

  condition: selection and selection_labels

falsepositives:
  - Legitimate CI or orchestration containers that intentionally mount the Docker socket or run with elevated flags for build automation.

level: high

T1611 Escape to Host

title: T1611 Escape to Host
id: a9c7dca4-4972-476c-a51d-701f919ea482
description: 'Detection Strategy for Escape to Host. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedKernelModules.'
references:
  - https://attack.mitre.org/techniques/T1611
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1611

logsource:
  product: esxi
  service: vmkernel

detection:
  selection:
    Message|contains:
      - 'PANIC'
      - 'unexpected access'
  selection_device:
    Message|contains:
      - 'passthrough'
      - 'PVSCSI'
      - 'vmxnet'

  condition: selection and selection_device

falsepositives:
  - Genuine hardware or driver faults on passthrough or virtual device emulation unrelated to an escape attempt; VM-to-hypervisor escape is a very rare event and AllowedKernelModules deviation combined with this signal should be manually validated rather than treated as high-confidence alone.

level: critical

Explore