Title:
Container Residence Discovery Via Proc Virtual FS
Status:
test
Description:Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
References:
-https://blog.skyplabs.net/posts/container-detection/
-https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
Author: Seth Hanford
Date: 2023-08-23
modified:None
Tags:
- -'attack.discovery'
- -'attack.t1082'
Logsource:
- category: process_creation
- product: linux
Detection:
selection_tools:
Image|endswith:
-'awk'
-'/cat'
-'grep'
-'/head'
-'/less'
-'/more'
-'/nl'
-'/tail'
selection_procfs_kthreadd:
CommandLine|contains:
'/proc/2/'
selection_procfs_target:
CommandLine|contains:
'/proc/'
CommandLine|endswith:
-'/cgroup'
-'/sched'
condition:
selection_tools and 1 of selection_procfs_*
Falsepositives:
-Legitimate system administrator usage of these commands
-Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
Level:
low
