Detection: Cisco Isovalent - Potential Escape to Host

Description

This analytic detects potential container escape or reconnaissance attempts by monitoring for the rapid execution of multiple suspicious Linux commands (nsenter, mount, ps aux, and ls) within a short time window. The search aggregates process execution logs into 5-minute buckets and identifies when two or more distinct commands occur in quick succession. This behavior is noteworthy because attackers often chain these commands together to pivot from a container into the host, enumerate processes, or browse filesystems. For a SOC, catching these clustered command executions is important because it highlights possible adversary activity attempting to break isolation and escalate privileges inside a Kubernetes environment.

Search

 1`cisco_isovalent_process_exec`
 2
 3(
 4    process_name IN ("nsenter","mount","ps","ls")
 5    OR
 6    process IN ("*nsenter*", "*mount*", "*ps aux*", "*ps -ef*")
 7)
 8
 9| bin _time span=5m
10
11| stats 
12    count AS total_events
13    dc(process_name) AS distinct_cmds
14    min(_time) AS firstTime
15    max(_time) AS lastTime
16    values(process) AS process
17    values(process_name) AS process_name
18  BY cluster_name node_name pod_name _time
19
20| eval duration_s = round(lastTime - firstTime, 0)
21
22| where distinct_cmds >= 2 AND duration_s <= 120
23
24| table _time cluster_name node_name pod_name total_events distinct_cmds duration_s firstTime lastTime process process_name
25
26| `security_content_ctime(firstTime)`
27
28| `security_content_ctime(lastTime)`
29
30| `cisco_isovalent___potential_escape_to_host_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This detection relies on process execution telemetry from Cisco Isovalent Runtime Security. Ensure Isovalent Runtime Security is deployed and configured in your Kubernetes environment to generate process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HEC and normalize them into Splunk CIM. Privileged pods and hostPID configurations should be closely monitored as they increase the risk of container escape attempts.

Known False Positives

Some legitimate administrative containers or troubleshooting workflows may use nsenter or mount commands (e.g., debugging nodes with hostPID pods). Such activity should be investigated in context to ensure it is not malicious.

Associated Analytic Story

• Cisco Isovalent Suspicious Activity

Risk Based Analytics (RBA)

Risk Message:

Escape-to-host attempt detected in pod $pod_name$ on cluster $cluster_name$ using a command - [$process$]

References

• https://attack.mitre.org/techniques/T1611/

• https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1