Elastic Security Detection Rules

Chroot Execution in Container Context on Linux

Last updated 6 days ago on 2026-04-27
Created 6 days ago on 2026-04-27

About

Detects chroot execution on Linux when the process appears to run in a container-oriented context: the process title matches runc init, the entry leader is a container workload, or the parent process is runc. Chroot from inside a container can pivot to an alternate root filesystem and is a common step in container breakout attempts when combined with sensitive host mounts.
Tags
Data Source: Auditd ManagerData Source: Elastic DefendDomain: ContainerDomain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Privilege EscalationLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Escape to Host (T1611)(external, opens in a new tab or window)

False Positive Examples
Build and packaging images sometimes run chroot against a staged root filesystem inside CI or init containers; correlate with approved pipelines and image build jobs before escalating.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
auditbeat-*logs-auditd_manager.auditd-*logs-endpoint.events.process*
Related Integrations

endpoint(external, opens in a new tab or window)

auditd_manager(external, opens in a new tab or window)

Query
text code block:
host.os.type:linux and event.category:process and 
event.type:start and event.action:(executed or exec) and 
(process.name:"chroot" or process.args:("chroot" or "/bin/chroot" or "/usr/bin/chroot" or "/usr/local/bin/chroot")) and 
(process.title:"runc init" or process.entry_leader.entry_meta.type:"container" or process.parent.name:("runc" or "containerd-shim-runc-v2"))

Install detection rules in Elastic Security

Detect Chroot Execution in Container Context on Linux in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).