Windows Container Escape - Runtime Shell Spawn or Host Device Path Access

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.