DETECT CONTAINER ESCAPE VULNERABILITIES WITH OSQUERY

Summary from the TLDR InfoSec newsletter

This guide explains how to use Osquery to detect container escape vulnerabilities in real-time by monitoring suspicious system calls and container activities. It presents three practical SQL queries that can be scheduled to run at 30-second intervals to detect namespace pivots, CVE-2024-21626 style escapes, and containers attempting to access the host kernel or metadata services. The guide also covers deployment steps, performance tuning tips, and integration options with logging platforms like Uptycs, Fleet, Splunk, and Loki.