Skip to main content
Version: 2.8

⚙️ Runc Suspicious Exec

Quick Explanation​

Quick Summary: The runc_suspicious_exec detection recipe identifies instances where the runc binary is executed by an unknown or unexpected process, which can be indicative of a potential threat. This event could lead to unauthorized access or control over containerized environments, posing significant risks to the CI/CD pipeline and potentially allowing attackers to leverage these environments for further malicious activities.

More Information​

📋 Detection Metadata​

Description: runc binary executed by a suspicious process
Tactic: Execution
Technique: Container Administration Command
Importance: Critical

🔍 Event Analysis​

This detection indicates that container runtime binaries were executed by an unknown or unexpected process, which is flagged as suspicious because these binaries are typically invoked by recognized container runtime managers. The execution of container runtime binaries by an unauthorized process could suggest a sophisticated attack vector where adversaries are attempting to masquerade their malicious activities as legitimate operations.


This event aligns with the MITRE ATT&CK framework under the Defense Evasion category and employs techniques such as T1036 (Masquerading) and T1218 (Supply Chain Compromise). Adversaries may exploit vulnerabilities in the supply chain to introduce backdoors or malicious code that can be triggered later, leading to unauthorized execution of container runtime binaries.


The critical importance of this detection underscores the potential for significant security breaches. Attackers could leverage such events to gain persistent access within containerized environments, deploy additional malware, and perform lateral movement across network segments.

💡 Security Implications​

🔄 CI/CD Pipeline​

🧪 Staging Environment​

🚀 Production Environment​

✅ CI/CD Actions​

  1. Investigate the Source: Immediately review the logs and trace back the source of the unexpected runc execution. Identify any recent changes or deployments that might have introduced unauthorized processes.
  2. Review Dependencies: Conduct a thorough audit of all dependencies and third-party libraries used in the pipeline to ensure no malicious code has been introduced.
  3. Enhance Security Measures: Implement stricter access controls and authentication mechanisms for the CI/CD environment to prevent unauthorized access.

✅ Staging Actions​

  1. Conduct Security Testing: Perform comprehensive security testing to identify vulnerabilities that could be exploited by attackers during the staging phase.
  2. Limit Access: Restrict access to the staging environment to only essential personnel and processes, minimizing the risk of insider threats.
  3. Data Protection: Ensure that sensitive data is encrypted and that data access is logged and monitored for any unauthorized attempts.

✅ Production Actions​

  1. Isolate Affected Systems: If suspicious activity is detected, isolate the affected systems to prevent further spread of potential threats.
  2. Patch and Update: Ensure all systems and containers are up-to-date with the latest security patches to mitigate known vulnerabilities.
  3. Conduct a Security Audit: Perform a thorough security audit to identify and close any gaps that could be exploited by attackers.
  4. Incident Response Plan: Review and update the incident response plan to ensure quick and effective action can be taken in the event of a security breach.

🔗 Related Resources​