Docker CLI Bind Mount of Host Path Executed via docker-users Group Access

Duo Tech@duotech

•updated Jul 20, 2026•0•0•0

Detects Docker CLI execution attempting to bind mount sensitive host system directories (e.g., Windows, ProgramData) into a container. This technique is often used as a container escape vector to gain unauthorized access to host files and escalate privileges to SYSTEM.