T1610

Deploy Container

discovered 2026-06-01

Attempts Docker socket container escape, mounting /etc/sudoers.d and granting the runner NOPASSWD sudo.

View on MITRE ATT&CK

Seen in packages

Campaigns