From dbbcc7e7035369c7d49fc45f4c976a226e9e7a99 Mon Sep 17 00:00:00 2001
From: "Chris (ChrisJr404)" <11917633+ChrisJr404@users.noreply.github.com>
Date: Wed, 26 Aug 2026 13:32:58 -0400
Subject: [PATCH] Add sandbox rule for container escape via kernel usermode
 helper overwrite

Signed-off-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com>
---
 rules/falco-sandbox_rules.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/rules/falco-sandbox_rules.yaml b/rules/falco-sandbox_rules.yaml
index e9a24536..829f5dd5 100644
--- a/rules/falco-sandbox_rules.yaml
+++ b/rules/falco-sandbox_rules.yaml
@@ -1700,6 +1700,23 @@
   priority: WARNING
   tags: [maturity_sandbox, container, filesystem, mitre_initial_access, T1611]
 
+- rule: Container Escape via Kernel Usermode Helper Overwrite
+  desc: >
+    Detect an attempt to escape from a container to the host by overwriting a kernel usermode helper program path,
+    such as /proc/sys/kernel/core_pattern or /proc/sys/kernel/modprobe_path. When one of these files is set to a
+    command, the host kernel later runs it as root, on a process crash for core_pattern or on a module autoload for
+    modprobe_path, which yields code execution on the host outside the container. Writing these files needs a
+    privileged context, so a write from inside a container is a high signal indicator of a container escape attempt.
+  condition: >
+    open_write
+    and container
+    and (fd.name endswith sys/kernel/core_pattern or fd.name endswith sys/kernel/modprobe_path)
+    and (user.uid=0 or thread.cap_effective contains CAP_DAC_OVERRIDE)
+    and thread.cap_effective contains CAP_SYS_ADMIN
+  output: Kernel usermode helper overwritten from container for host escape | file=%fd.name cap_effective=%thread.cap_effective evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
+  priority: CRITICAL
+  tags: [maturity_sandbox, container, filesystem, mitre_privilege_escalation, T1611]
+
 - list: known_decode_payload_containers
   items: []