---
title: Nsenter to PID Namespace via Auditd
description: Detects nsenter executions that target PID with a namespace target flag, a pattern commonly used to attach to the host init namespace from a container...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_auditd_nsenter_target_host_pid
products:
  - Elastic Security
---

# Nsenter to PID Namespace via Auditd
Detects nsenter executions that target PID with a namespace target flag, a pattern commonly used to attach to the
host init namespace from a container or session and run with host context.
**Rule type**: query
**Rule indices**:
- auditbeat-*
- logs-auditd_manager.auditd-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://attack.mitre.org/techniques/T1611/](https://attack.mitre.org/techniques/T1611/)](https://attack.mitre.org/techniques/T1611/)
- [[https://man7.org/linux/man-pages/man1/nsenter.1.html](https://man7.org/linux/man-pages/man1/nsenter.1.html)](https://man7.org/linux/man-pages/man1/nsenter.1.html)

**Tags**:
- Domain: Endpoint
- Domain: Containers
- OS: Linux
- Use Case: Threat Detection
- Tactic: Privilege Escalation
- Data Source: Auditd Manager
- Resources: Investigation Guide
- Noise: Low
- Performance: Normal
- Profile: Recommended
- Threat: Container Escape
- Rule Type: Custom Query (KQL)
- Platform: Linux

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

Deploy the Auditd Manager integration on Linux hosts that should emit process execution telemetry (Fleet, Integrations,
Auditd Manager, attach to an agent policy).
Ensure syscall rules capture execve for utilities such as nsenter so event.category process and event.action executed
populate with process.name and process.args.
See [https://docs.elastic.co/integrations/auditd_manager](https://docs.elastic.co/integrations/auditd_manager) for integration details.

## Investigation guide


## Triage and analysis


### Investigating Nsenter to PID Namespace via Auditd

Review process.args for the full nsenter invocation (target PID, mount, UTS, IPC, net, user namespaces), parent process,
user identity, and host. PID targeting is a strong escape or host-administration signal when unexpected for the actor.

### Possible investigation steps

- Confirm whether the session originated from a container, SSH session, or automation agent.
- Pivot on the same host for subsequent writes under /etc, docker.sock access, or new systemd units.


### False positive analysis

- Some CNI or snap workflows can resemble nsenter; rely on the built-in exclusions first, then tune by parent command
  or service account.


### Response and remediation

- If malicious, isolate the host, revoke credentials, inspect for persistence, and re-image if integrity cannot be proven.


## Rule Query

```kuery
host.os.type:linux and event.category:process and event.action:(exec or executed) and
(process.name:nsenter or process.args:nsenter) and
process.args:(
  (-t or --target*) and
  not --net=/run/netns/* and
  not (--assertion and snap) and
  not (is-active and snap.*) and
  not (-anp and netstat)
)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Escape to Host
  - Id: T1611
  - Reference URL: [[https://attack.mitre.org/techniques/T1611/](https://attack.mitre.org/techniques/T1611/)](https://attack.mitre.org/techniques/T1611/)