mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
54 lines
2.3 KiB
Markdown
54 lines
2.3 KiB
Markdown
# Standards Reference - Container Escape Detection
|
|
|
|
## MITRE ATT&CK for Containers
|
|
|
|
### T1611 - Escape to Host
|
|
- **Tactic**: Privilege Escalation
|
|
- **Description**: Adversaries may escape container isolation and gain access to the host
|
|
- **Sub-techniques**: Privileged container, nsenter, cgroup escape, kernel exploit
|
|
- **Detection**: Monitor for namespace manipulation, sensitive path access, privilege changes
|
|
|
|
### T1610 - Deploy Container
|
|
- **Tactic**: Execution
|
|
- **Description**: Deploy a new container using Docker socket access from within a container
|
|
|
|
### T1068 - Exploitation for Privilege Escalation
|
|
- **Tactic**: Privilege Escalation
|
|
- **Description**: Exploit kernel vulnerabilities for container escape (Dirty Pipe, runc CVEs)
|
|
|
|
### T1548 - Abuse Elevation Control Mechanism
|
|
- **Sub-technique**: T1548.004 - Elevated Execution with Prompt
|
|
- **Description**: Abuse Linux capabilities like CAP_SYS_ADMIN for escape
|
|
|
|
## Known Container Escape CVEs
|
|
|
|
| CVE | Component | Description | CVSS |
|
|
|-----|-----------|-------------|------|
|
|
| CVE-2024-21626 | runc | Working directory escape via /proc/self/fd leak | 8.6 |
|
|
| CVE-2022-0185 | Linux kernel | fsconfig heap overflow, namespace escape | 8.4 |
|
|
| CVE-2022-0847 | Linux kernel | Dirty Pipe - arbitrary file overwrite | 7.8 |
|
|
| CVE-2021-22555 | Linux kernel | Netfilter heap OOB, container escape | 7.8 |
|
|
| CVE-2020-15257 | containerd | Abstract socket namespace escape | 5.2 |
|
|
| CVE-2019-5736 | runc | Binary overwrite, host code execution | 8.6 |
|
|
|
|
## NIST SP 800-190 - Application Container Security Guide
|
|
|
|
### Container Runtime Security
|
|
- Monitor containers for anomalous behavior
|
|
- Detect attempts to access host namespaces
|
|
- Alert on kernel module loading from containers
|
|
- Implement syscall filtering with seccomp
|
|
|
|
## Linux Capabilities Required for Escape
|
|
|
|
| Capability | Escape Risk | Description |
|
|
|-----------|------------|-------------|
|
|
| CAP_SYS_ADMIN | Critical | Mount filesystems, namespace manipulation |
|
|
| CAP_SYS_PTRACE | Critical | ptrace processes, inspect memory |
|
|
| CAP_NET_ADMIN | High | Network namespace manipulation |
|
|
| CAP_SYS_MODULE | Critical | Load kernel modules |
|
|
| CAP_SYS_RAWIO | High | Raw I/O access, iopl/ioperm |
|
|
| CAP_DAC_OVERRIDE | High | Bypass file read/write permission |
|
|
| CAP_DAC_READ_SEARCH | Medium | Bypass file read permission |
|
|
| CAP_MKNOD | Medium | Create device files |
|