[New Rule] PE through Writable Docker Socket

[Aegrah]

Summary

This rule monitors for the usage of Docker runtime sockets to escalate privileges on Linux systems. Docker sockets by default are only be writable by the root user and docker group. Attackers that have permissions to write to these sockets may be able to create and run a container that allows them to escalate privileges and gain further access onto the host file system.

Detection

0 hits last 365 days in red sector, nor in my docker test clusters. Added and not user.Ext.real.id : "0" and not group.Ext.real.id : "0" to minimize FPs.

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and 
(
  (process.name == "docker" and process.args : "run" and process.args : "-it"  and 
   process.args : ("unix://*/docker.sock", "unix://*/dockershim.sock")) or 
  (process.name == "socat" and process.args : ("UNIX-CONNECT:*/docker.sock", "UNIX-CONNECT:*/dockershim.sock"))
) and not user.Ext.real.id : "0" and not group.Ext.real.id : "0"

[w0rk3r]

🔥

[eric-forte-elastic]

Great rule 🔥

There are some instances where users will need to use docker runtime sockets to route control of the docker interface in some more intricate development environments. However, these are few and far between and I have not seen one that also makes use of -it as one might use for privilege escalation. Great Work!