Container Escape via nsenter to Host
Identifies the use of the nsenter utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.
Microsoft Sentinel (KQL)
