Skip to content

Commit 83a1ec8

Browse files
Aegrahimays11
andauthored
Update rules/linux/privilege_escalation_mount_launched_inside_container.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
1 parent ca2ff37 commit 83a1ec8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/linux/privilege_escalation_mount_launched_inside_container.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ updated_date = "2025/03/12"
77
[rule]
88
author = ["Elastic"]
99
description = """
10-
This rule detects the use of the mount utility from inside a privileged container. The mount command is used to make a
10+
This rule detects the use of the mount utility from inside a container. The mount command is used to make a
1111
device or file system accessible to the system, and then to connect its root directory to a specified mount point on the
1212
local file system. When launched inside a privileged container--a container deployed with all the capabilities of the
1313
host machine-- an attacker can access sensitive host level files which could be used for further privilege escalation

0 commit comments

Comments
 (0)