Elastic Security Detection Rules

Unusual Process Connection to Docker or Containerd Socket

Last updated 4 days ago on 2026-04-29
Created 4 days ago on 2026-04-29

About

Detects a process connecting to a container runtime Unix socket (containerd or Docker) that is not a known legitimate runtime component. Direct access to the container runtime socket allows an attacker to create, exec into, or manipulate containers without going through the Kubernetes API server, bypassing RBAC, admission webhooks, pod security standards, and Kubernetes audit logging entirely.
Tags
Data Source: Auditd ManagerDomain: EndpointDomain: ContainerOS: LinuxUse Case: Threat DetectionTactic: DiscoveryTactic: Privilege EscalationTactic: Lateral MovementLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Container and Resource Discovery (T1613)(external, opens in a new tab or window)

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Escape to Host (T1611)(external, opens in a new tab or window)

Lateral Movement (TA0008)(external, opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(external, opens in a new tab or window)

False Positive Examples
Custom container tooling, CI agents, or monitoring may connect to docker.sock or containerd.sock from non-standard paths after relocation or bind mounts. Tune by process.executable or user.name when noise is high.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
auditbeat-*logs-auditd_manager.auditd-*
Related Integrations

auditd_manager(external, opens in a new tab or window)

Query
text code block:
host.os.type:"linux" and 
event.category:"network" and
event.action:"connected-to" and network.direction:"egress" and 
destination.address:("/run/containerd/containerd.sock" or "/var/run/containerd/containerd.sock" or "/var/run/docker.sock" or "/run/docker.sock") and
process.executable:(* and not 
  ("/usr/bin/kubelet" or
  "/usr/local/bin/kubelet" or
  "/usr/bin/containerd" or
  "/usr/sbin/containerd" or
  "/usr/bin/containerd-shim" or
  "/usr/bin/containerd-shim-runc-v2" or
  "/usr/local/bin/containerd-shim-runc-v2" or
  "/usr/bin/dockerd" or
  "/usr/sbin/dockerd" or  
   /var/lib/*/usr/bin/dockerd or 
  "/usr/bin/docker-proxy")
)

Install detection rules in Elastic Security

Detect Unusual Process Connection to Docker or Containerd Socket in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).