Container Escape via nsenter to Host PID 1

Tim Peck@timpeck

•updated Jun 1, 2026•3•0•11

Detects the use of the `nsenter` utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.