# Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. --- images: pull_policy: IfNotPresent tags: dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0 falco: docker.io/sysdig/falco:0.12.1 image_repo_sync: docker.io/docker:17.07.0 local_registry: active: false exclude: - dep_check - image_repo_sync pod: resources: enabled: false falco: requests: memory: "128Mi" cpu: "20m" limits: memory: "128Mi" cpu: "30m" jobs: image_repo_sync: requests: memory: "128Mi" cpu: "20m" limits: memory: "128Mi" cpu: "30m" lifecycle: upgrades: daemonsets: pod_replacement_strategy: RollingUpdate falco: enabled: true min_ready_seconds: 0 max_unavailable: 1 tolerations: falco: tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master conf: config: # The location of the rules file(s). This can contain one or more paths to # separate rules files. rules_file: - /etc/falco/falco_rules.yaml - /etc/falco/falco_rules.local.yaml - /etc/falco/rules.d # Whether to output events in json or text json_output: false # When using json output, whether or not to include the "output" property # itself (e.g. "File below a known binary directory opened for writing # (user=root ....") in the json output. json_include_output_property: true # Send information logs to stderr and/or syslog Note these are *not* security # notification logs! These are just Falco lifecycle (and possibly error) logs. log_stderr: true log_syslog: true # Minimum log level to include in logs. Note: these levels are # separate from the priority field of rules. This refers only to the # log level of falco's internal logging. Can be one of "emergency", # "alert", "critical", "error", "warning", "notice", "info", "debug". log_level: info # Minimum rule priority level to load and run. All rules having a # priority more severe than this level will be loaded/run. Can be one # of "emergency", "alert", "critical", "error", "warning", "notice", # "info", "debug". priority: debug # Whether or not output to any of the output channels below is # buffered. buffered_outputs: false # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: # - rate: the number of tokens (i.e. right to send a notification) # gained per second. Defaults to 1. # - max_burst: the maximum number of tokens outstanding. Defaults to 1000. # # With these defaults, falco could send up to 1000 notifications after # an initial quiet period, and then up to 1 notification per second # afterward. It would gain the full burst back after 1000 seconds of # no activity. outputs: rate: 1 max_burst: 1000 # Where security notifications should go. # Multiple outputs can be enabled. syslog_output: enabled: true # If keep_alive is set to true, the file will be opened once and # continuously written to, with each output message on its own # line. If keep_alive is set to false, the file will be re-opened # for each output message. # # Also, the file will be closed and reopened if falco is signaled with # SIGUSR1. file_output: enabled: false keep_alive: false filename: ./events.txt stdout_output: enabled: true # Possible additional things you might want to do with program output: # - send to a slack webhook: # program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX" # - logging (alternate method than syslog): # program: logger -t falco-test # - send over a network connection: # program: nc host.example.com 80 # If keep_alive is set to true, the program will be started once and # continuously written to, with each output message on its own # line. If keep_alive is set to false, the program will be re-spawned # for each output message. # # Also, the program will be closed and reopened if falco is signaled with # SIGUSR1. program_output: enabled: false keep_alive: false program: mail -s "Falco Notification" someone@example.com rules: falco_rules: | - macro: open_write condition: (evt.type=open or evt.type=openat) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0 - macro: open_read condition: (evt.type=open or evt.type=openat) and evt.is_open_read=true and fd.typechar='f' and fd.num>=0 - macro: never_true condition: (evt.num=0) - macro: always_true condition: (evt.num=>0) - macro: proc_name_exists condition: (proc.name!="") - macro: rename condition: evt.type in (rename, renameat) - macro: mkdir condition: evt.type = mkdir - macro: remove condition: evt.type in (rmdir, unlink, unlinkat) - macro: modify condition: rename or remove - macro: spawned_process condition: evt.type = execve and evt.dir=< - macro: bin_dir condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin) - macro: bin_dir_mkdir condition: > (evt.arg[1] startswith /bin/ or evt.arg[1] startswith /sbin/ or evt.arg[1] startswith /usr/bin/ or evt.arg[1] startswith /usr/sbin/) - macro: bin_dir_rename condition: > evt.arg[1] startswith /bin/ or evt.arg[1] startswith /sbin/ or evt.arg[1] startswith /usr/bin/ or evt.arg[1] startswith /usr/sbin/ - macro: etc_dir condition: fd.name startswith /etc/ - macro: root_dir condition: ((fd.directory=/ or fd.name startswith /root) and fd.name contains "/") - list: shell_binaries items: [bash, csh, ksh, sh, tcsh, zsh, dash] - list: shell_mgmt_binaries items: [add-shell, remove-shell] - macro: shell_procs condition: (proc.name in (shell_binaries)) - list: coreutils_binaries items: [ truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who, groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat, basename, split, nice, "yes", whoami, sha224sum, hostid, users, stdbuf, base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test, comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname, tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout, tail, "[", seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred, tac, link, chroot, vdir, chown, touch, ls, dd, uname, "true", pwd, date, chgrp, chmod, mktemp, cat, mknod, sync, ln, "false", rm, mv, cp, echo, readlink, sleep, stty, mkdir, df, dir, rmdir, touch ] - list: login_binaries items: [ login, systemd, '"(systemd)"', systemd-logind, su, nologin, faillog, lastlog, newgrp, sg ] - list: passwd_binaries items: [ shadowconfig, grpck, pwunconv, grpconv, pwck, groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod, groupadd, groupdel, grpunconv, chgpasswd, userdel, chage, chsh, gpasswd, chfn, expiry, passwd, vigr, cpgr ] - list: shadowutils_binaries items: [ chage, gpasswd, lastlog, newgrp, sg, adduser, deluser, chpasswd, groupadd, groupdel, addgroup, delgroup, groupmems, groupmod, grpck, grpconv, grpunconv, newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw, unix_chkpwd ] - list: sysdigcloud_binaries items: [setup-backend, dragent, sdchecks] - list: docker_binaries items: [docker, dockerd, exe, docker-compose, docker-entrypoi, docker-runc-cur, docker-current] - list: k8s_binaries items: [hyperkube, skydns, kube2sky, exechealthz] - list: lxd_binaries items: [lxd, lxcfs] - list: http_server_binaries items: [nginx, httpd, httpd-foregroun, lighttpd, apache, apache2] - list: db_server_binaries items: [mysqld, postgres, sqlplus] - list: mysql_mgmt_binaries items: [mysql_install_d, mysql_ssl_rsa_s] - list: postgres_mgmt_binaries items: [pg_dumpall, pg_ctl, pg_lsclusters, pg_ctlcluster] - list: db_mgmt_binaries items: [mysql_mgmt_binaries, postgres_mgmt_binaries] - list: nosql_server_binaries items: [couchdb, memcached, redis-server, rabbitmq-server, mongod] - list: gitlab_binaries items: [gitlab-shell, gitlab-mon, gitlab-runner-b, git] - macro: server_procs condition: proc.name in (http_server_binaries, db_server_binaries, docker_binaries, sshd) - list: rpm_binaries items: [dnf, rpm, rpmkey, yum, '"75-system-updat"', rhsmcertd-worke, subscription-ma, repoquery, rpmkeys, rpmq, yum-cron, yum-config-mana, yum-debug-dump, abrt-action-sav, rpmdb_stat, microdnf] - macro: rpm_procs condition: proc.name in (rpm_binaries) or proc.name in (salt-minion) - list: deb_binaries items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude, frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key, apt-listchanges, unattended-upgr, apt-add-reposit ] - list: package_mgmt_binaries items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client] - macro: package_mgmt_procs condition: proc.name in (package_mgmt_binaries) - macro: coreos_write_ssh_dir condition: (proc.name=update-ssh-keys and fd.name startswith /home/core/.ssh) - macro: run_by_package_mgmt_binaries condition: proc.aname in (package_mgmt_binaries, needrestart) - list: ssl_mgmt_binaries items: [ca-certificates] - list: dhcp_binaries items: [dhclient, dhclient-script] - list: userexec_binaries items: [sudo, su, suexec] - list: known_setuid_binaries items: [ sshd, dbus-daemon-lau, ping, ping6, critical-stack-, pmmcli, filemng, PassengerAgent, bwrap, osdetect, nginxmng, sw-engine-fpm, start-stop-daem ] - list: user_mgmt_binaries items: [login_binaries, passwd_binaries, shadowutils_binaries] - list: dev_creation_binaries items: [blkid, rename_device, update_engine, sgdisk] - list: hids_binaries items: [aide] - list: vpn_binaries items: [openvpn] - list: nomachine_binaries items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin] - macro: system_procs condition: proc.name in (coreutils_binaries, user_mgmt_binaries) - list: mail_binaries items: [ sendmail, sendmail-msp, postfix, procmail, exim4, pickup, showq, mailq, dovecot, imap-login, imap, mailmng-core, pop3-login, dovecot-lda, pop3 ] - list: mail_config_binaries items: [ update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4, update_db, update_mc, ssmtp.postinst, mailq, postalias, postfix.config., postfix.config, postfix-script ] - list: sensitive_file_names items: [/etc/shadow, /etc/sudoers, /etc/pam.conf] - macro: sensitive_files condition: > fd.name startswith /etc and (fd.name in (sensitive_file_names) or fd.directory in (/etc/sudoers.d, /etc/pam.d)) - macro: proc_is_new condition: proc.duration <= 5000000000 - macro: inbound condition: > (((evt.type in (accept,listen) and evt.dir=<)) or (fd.typechar = 4 or fd.typechar = 6) and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS)) - macro: outbound condition: > (((evt.type = connect and evt.dir=<)) or (fd.typechar = 4 or fd.typechar = 6) and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS)) - macro: inbound_outbound condition: > (((evt.type in (accept,listen,connect) and evt.dir=<)) or (fd.typechar = 4 or fd.typechar = 6) and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS)) - macro: ssh_port condition: fd.sport=22 - macro: allowed_ssh_hosts condition: ssh_port - rule: Disallowed SSH Connection desc: Detect any new ssh connection to a host other than those in an allowed group of hosts condition: (inbound_outbound) and ssh_port and not allowed_ssh_hosts output: Disallowed SSH Connection (command=%proc.cmdline connection=%fd.name user=%user.name) priority: NOTICE tags: [network] - macro: container condition: container.id != host - macro: interactive condition: > ((proc.aname=sshd and proc.name != sshd) or proc.name=systemd-logind or proc.name=login) - list: cron_binaries items: [anacron, cron, crond, crontab] - list: needrestart_binaries items: [needrestart, 10-dpkg, 20-rpm, 30-pacman] - list: sshkit_script_binaries items: [10_etc_sudoers., 10_passwd_group] - list: plesk_binaries items: [sw-engine, sw-engine-fpm, sw-engine-kv, filemng, f2bmng] - macro: system_users condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data) - macro: parent_ansible_running_python condition: (proc.pname in (python, pypy) and proc.pcmdline contains ansible) - macro: parent_bro_running_python condition: (proc.pname=python and proc.cmdline contains /usr/share/broctl) - macro: parent_python_running_denyhosts condition: > (proc.cmdline startswith "denyhosts.py /usr/bin/denyhosts.py" or (proc.pname=python and (proc.pcmdline contains /usr/sbin/denyhosts or proc.pcmdline contains /usr/local/bin/denyhosts.py))) - macro: parent_python_running_sdchecks condition: > (proc.pname in (python, python2.7) and (proc.pcmdline contains /opt/draios/bin/sdchecks)) - macro: parent_linux_image_upgrade_script condition: proc.pname startswith linux-image- - macro: parent_java_running_echo condition: (proc.pname=java and proc.cmdline startswith "sh -c echo") - macro: parent_scripting_running_builds condition: > (proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,ruby2.1,node,conda) and ( proc.cmdline startswith "sh -c git" or proc.cmdline startswith "sh -c date" or proc.cmdline startswith "sh -c /usr/bin/g++" or proc.cmdline startswith "sh -c /usr/bin/gcc" or proc.cmdline startswith "sh -c gcc" or proc.cmdline startswith "sh -c if type gcc" or proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git" or proc.cmdline startswith "sh -c /var/www/edi/bin/sftp.sh" or proc.cmdline startswith "sh -c /usr/src/app/crxlsx/bin/linux/crxlsx" or proc.cmdline startswith "sh -c make parent" or proc.cmdline startswith "node /jenkins/tools" or proc.cmdline startswith "sh -c '/usr/bin/node'" or proc.cmdline startswith "sh -c stty -a |" or proc.pcmdline startswith "node /opt/nodejs/bin/yarn" or proc.pcmdline startswith "node /usr/local/bin/yarn" or proc.pcmdline startswith "node /root/.config/yarn" or proc.pcmdline startswith "node /opt/yarn/bin/yarn.js")) - macro: httpd_writing_ssl_conf condition: > (proc.pname=run-httpd and (proc.cmdline startswith "sed -ri" or proc.cmdline startswith "sed -i") and (fd.name startswith /etc/httpd/conf.d/ or fd.name startswith /etc/httpd/conf)) - macro: userhelper_writing_etc_security condition: (proc.name=userhelper and fd.name startswith /etc/security) - macro: parent_Xvfb_running_xkbcomp condition: (proc.pname=Xvfb and proc.cmdline startswith 'sh -c "/usr/bin/xkbcomp"') - macro: parent_nginx_running_serf condition: (proc.pname=nginx and proc.cmdline startswith "sh -c serf") - macro: parent_node_running_npm condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or proc.pcmdline startswith "node /usr/local/nodejs/bin/npm" or proc.pcmdline startswith "node /opt/rh/rh-nodejs6/root/usr/bin/npm") - macro: parent_java_running_sbt condition: (proc.pname=java and proc.pcmdline contains sbt-launch.jar) - list: known_container_shell_spawn_cmdlines items: [] - list: known_shell_spawn_binaries items: [] - macro: ansible_running_python condition: (proc.name in (python, pypy) and proc.cmdline contains ansible) - macro: python_running_chef condition: (proc.name=python and (proc.cmdline contains yum-dump.py or proc.cmdline="python /usr/bin/chef-monitor.py")) - macro: python_running_denyhosts condition: > (proc.name=python and (proc.cmdline contains /usr/sbin/denyhosts or proc.cmdline contains /usr/local/bin/denyhosts.py)) - macro: run_by_qualys condition: > (proc.pname=qualys-cloud-ag or proc.aname[2]=qualys-cloud-ag or proc.aname[3]=qualys-cloud-ag or proc.aname[4]=qualys-cloud-ag) - macro: run_by_sumologic_securefiles condition: > ((proc.cmdline="usermod -a -G sumologic_collector" or proc.cmdline="groupadd sumologic_collector") and (proc.pname=secureFiles.sh and proc.aname[2]=java)) - macro: run_by_yum condition: ((proc.pname=sh and proc.aname[2]=yum) or (proc.aname[2]=sh and proc.aname[3]=yum)) - macro: run_by_ms_oms condition: > (proc.aname[3] startswith omsagent- or proc.aname[3] startswith scx-) - macro: run_by_google_accounts_daemon condition: > (proc.aname[1] startswith google_accounts or proc.aname[2] startswith google_accounts) - macro: run_by_chef condition: (proc.aname[2]=chef_command_wr or proc.aname[3]=chef_command_wr or proc.aname[2]=chef-client or proc.aname[3]=chef-client or proc.name=chef-client) - macro: run_by_adclient condition: (proc.aname[2]=adclient or proc.aname[3]=adclient or proc.aname[4]=adclient) - macro: run_by_centrify condition: (proc.aname[2]=centrify or proc.aname[3]=centrify or proc.aname[4]=centrify) - macro: run_by_puppet condition: (proc.aname[2]=puppet or proc.aname[3]=puppet) - macro: run_by_foreman condition: > (user.name=foreman and (proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or (proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby))) - macro: java_running_sdjagent condition: proc.name=java and proc.cmdline contains sdjagent.jar - macro: kubelet_running_loopback condition: (proc.pname=kubelet and proc.name=loopback) - macro: python_mesos_marathon_scripting condition: (proc.pcmdline startswith "python3 /marathon-lb/marathon_lb.py") - macro: splunk_running_forwarder condition: (proc.pname=splunkd and proc.cmdline startswith "sh -c /opt/splunkforwarder") - macro: parent_supervise_running_multilog condition: (proc.name=multilog and proc.pname=supervise) - macro: supervise_writing_status condition: (proc.name in (supervise,svc) and fd.name startswith "/etc/sb/") - macro: pki_realm_writing_realms condition: (proc.cmdline startswith "bash /usr/local/lib/pki/pki-realm" and fd.name startswith /etc/pki/realms) - macro: htpasswd_writing_passwd condition: (proc.name=htpasswd and fd.name=/etc/nginx/.htpasswd) - macro: lvprogs_writing_conf condition: > (proc.name in (dmeventd,lvcreate,pvscan) and (fd.name startswith /etc/lvm/archive or fd.name startswith /etc/lvm/backup or fd.name startswith /etc/lvm/cache)) - macro: ovsdb_writing_openvswitch condition: (proc.name=ovsdb-server and fd.directory=/etc/openvswitch) - macro: perl_running_plesk condition: (proc.cmdline startswith "perl /opt/psa/admin/bin/plesk_agent_manager" or proc.pcmdline startswith "perl /opt/psa/admin/bin/plesk_agent_manager") - macro: perl_running_updmap condition: (proc.cmdline startswith "perl /usr/bin/updmap") - macro: perl_running_centrifydc condition: (proc.cmdline startswith "perl /usr/share/centrifydc") - macro: parent_ucf_writing_conf condition: (proc.pname=ucf and proc.aname[2]=frontend) - macro: consul_template_writing_conf condition: > ((proc.name=consul-template and fd.name startswith /etc/haproxy) or (proc.name=reload.sh and proc.aname[2]=consul-template and fd.name startswith /etc/ssl)) - macro: countly_writing_nginx_conf condition: (proc.cmdline startswith "nodejs /opt/countly/bin" and fd.name startswith /etc/nginx) - list: ms_oms_binaries items: [omi.postinst, omsconfig.posti, scx.postinst, omsadmin.sh, omiagent] - macro: ms_oms_writing_conf condition: > ((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor) or proc.pname in (ms_oms_binaries) or proc.aname[2] in (ms_oms_binaries)) and (fd.name startswith /etc/opt/omi or fd.name startswith /etc/opt/microsoft/omsagent)) - macro: ms_scx_writing_conf condition: (proc.name in (GetLinuxOS.sh) and fd.name startswith /etc/opt/microsoft/scx) - macro: azure_scripts_writing_conf condition: (proc.pname startswith "bash /var/lib/waagent/" and fd.name startswith /etc/azure) - macro: azure_networkwatcher_writing_conf condition: (proc.name in (NetworkWatcherA) and fd.name=/etc/init.d/AzureNetworkWatcherAgent) - macro: couchdb_writing_conf condition: (proc.name=beam.smp and proc.cmdline contains couchdb and fd.name startswith /etc/couchdb) - macro: update_texmf_writing_conf condition: (proc.name=update-texmf and fd.name startswith /etc/texmf) - macro: slapadd_writing_conf condition: (proc.name=slapadd and fd.name startswith /etc/ldap) - macro: openldap_writing_conf condition: (proc.pname=run-openldap.sh and fd.name startswith /etc/openldap) - macro: ucpagent_writing_conf condition: (proc.name=apiserver and container.image startswith docker/ucp-agent and fd.name=/etc/authorization_config.cfg) - macro: iscsi_writing_conf condition: (proc.name=iscsiadm and fd.name startswith /etc/iscsi) - macro: symantec_writing_conf condition: > ((proc.name=symcfgd and fd.name startswith /etc/symantec) or (proc.name=navdefutil and fd.name=/etc/symc-defutils.conf)) - macro: liveupdate_writing_conf condition: (proc.cmdline startswith "java LiveUpdate" and fd.name in (/etc/liveupdate.conf, /etc/Product.Catalog.JavaLiveUpdate)) - macro: sosreport_writing_files condition: > (proc.name=urlgrabber-ext- and proc.aname[3]=sosreport and (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb)) - macro: pkgmgmt_progs_writing_pki condition: > (proc.name=urlgrabber-ext- and proc.pname in (yum, yum-cron, repoquery) and (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb)) - macro: update_ca_trust_writing_pki condition: (proc.pname=update-ca-trust and proc.name=trust and fd.name startswith /etc/pki) - macro: brandbot_writing_os_release condition: proc.name=brandbot and fd.name=/etc/os-release - macro: selinux_writing_conf condition: (proc.name in (semodule,genhomedircon,sefcontext_comp) and fd.name startswith /etc/selinux) - list: veritas_binaries items: [vxconfigd, sfcache, vxclustadm, vxdctl, vxprint, vxdmpadm, vxdisk, vxdg, vxassist, vxtune] - macro: veritas_driver_script condition: (proc.cmdline startswith "perl /opt/VRTSsfmh/bin/mh_driver.pl") - macro: veritas_progs condition: (proc.name in (veritas_binaries) or veritas_driver_script) - macro: veritas_writing_config condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom)) - macro: nginx_writing_conf condition: (proc.name=nginx and fd.name startswith /etc/nginx) - macro: nginx_writing_certs condition: > (((proc.name=openssl and proc.pname=nginx-launch.sh) or proc.name=nginx-launch.sh) and fd.name startswith /etc/nginx/certs) - macro: chef_client_writing_conf condition: (proc.pcmdline startswith "chef-client /opt/gitlab" and fd.name startswith /etc/gitlab) - macro: centrify_writing_krb condition: (proc.name in (adjoin,addns) and fd.name startswith /etc/krb5) - macro: cockpit_writing_conf condition: > ((proc.pname=cockpit-kube-la or proc.aname[2]=cockpit-kube-la) and fd.name startswith /etc/cockpit) - macro: ipsec_writing_conf condition: (proc.name=start-ipsec.sh and fd.directory=/etc/ipsec) - macro: exe_running_docker_save condition: (proc.cmdline startswith "exe /var/lib/docker" and proc.pname in (dockerd, docker)) - macro: sed_temporary_file condition: (proc.name=sed and fd.name startswith "/etc/sed") - macro: python_running_get_pip condition: (proc.cmdline startswith "python get-pip.py") - macro: python_running_ms_oms condition: (proc.cmdline startswith "python /var/lib/waagent/") - macro: gugent_writing_guestagent_log condition: (proc.name=gugent and fd.name=GuestAgent.log) - macro: dse_writing_tmp condition: (proc.name=dse-entrypoint and fd.name=/root/tmp__) - macro: zap_writing_state condition: (proc.name=java and proc.cmdline contains "jar /zap" and fd.name startswith /root/.ZAP) - macro: airflow_writing_state condition: (proc.name=airflow and fd.name startswith /root/airflow) - macro: rpm_writing_root_rpmdb condition: (proc.name=rpm and fd.directory=/root/.rpmdb) - macro: maven_writing_groovy condition: (proc.name=java and proc.cmdline contains "classpath /usr/local/apache-maven" and fd.name startswith /root/.groovy) - rule: Write below binary dir desc: an attempt to write to any file below a set of binary directories condition: > bin_dir and evt.dir = < and open_write and not package_mgmt_procs and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms output: > File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2]) priority: ERROR tags: [filesystem] - list: monitored_directories items: [/boot, /lib, /lib64, /usr/lib, /usr/local/lib, /usr/local/sbin, /usr/local/bin, /root/.ssh, /etc/cardserver] - macro: user_ssh_directory condition: (fd.name startswith '/home' and fd.name contains '.ssh') - macro: mkinitramfs_writing_boot condition: (proc.pname in (mkinitramfs, update-initramf) and fd.directory=/boot) - macro: monitored_dir condition: > (fd.directory in (monitored_directories) or user_ssh_directory) and not mkinitramfs_writing_boot - rule: Write below monitored dir desc: an attempt to write to any file below a set of binary directories condition: > evt.dir = < and open_write and monitored_dir and not package_mgmt_procs and not coreos_write_ssh_dir and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms output: > File below a monitored directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2]) priority: ERROR tags: [filesystem] - list: safe_etc_dirs items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig] - macro: fluentd_writing_conf_files condition: (proc.name=start-fluentd and fd.name in (/etc/fluent/fluent.conf, /etc/td-agent/td-agent.conf)) - macro: qualys_writing_conf_files condition: (proc.name=qualys-cloud-ag and fd.name=/etc/qualys/cloud-agent/qagent-log.conf) - macro: git_writing_nssdb condition: (proc.name=git-remote-http and fd.directory=/etc/pki/nssdb) - macro: plesk_writing_keys condition: (proc.name in (plesk_binaries) and fd.name startswith /etc/sw/keys) - macro: plesk_install_writing_apache_conf condition: (proc.cmdline startswith "bash -hB /usr/lib/plesk-9.0/services/webserver.apache configure" and fd.name="/etc/apache2/apache2.conf.tmp") - macro: plesk_running_mktemp condition: (proc.name=mktemp and proc.aname[3] in (plesk_binaries)) - macro: networkmanager_writing_resolv_conf condition: proc.aname[2]=nm-dispatcher and fd.name=/etc/resolv.conf - macro: add_shell_writing_shells_tmp condition: (proc.name=add-shell and fd.name=/etc/shells.tmp) - macro: duply_writing_exclude_files condition: (proc.name=touch and proc.pcmdline startswith "bash /usr/bin/duply" and fd.name startswith "/etc/duply") - macro: xmlcatalog_writing_files condition: (proc.name=update-xmlcatal and fd.directory=/etc/xml) - macro: datadog_writing_conf condition: ((proc.cmdline startswith "python /opt/datadog-agent" or proc.cmdline startswith "entrypoint.sh /entrypoint.sh datadog start" or proc.cmdline startswith "agent.py /opt/datadog-agent") and fd.name startswith "/etc/dd-agent") - macro: curl_writing_pki_db condition: (proc.name=curl and fd.directory=/etc/pki/nssdb) - macro: haproxy_writing_conf condition: ((proc.name in (update-haproxy-,haproxy_reload.) or proc.pname in (update-haproxy-,haproxy_reload,haproxy_reload.)) and (fd.name=/etc/openvpn/client.map or fd.name startswith /etc/haproxy)) - macro: java_writing_conf condition: (proc.name=java and fd.name=/etc/.java/.systemPrefs/.system.lock) - macro: rabbitmq_writing_conf condition: (proc.name=rabbitmq-server and fd.directory=/etc/rabbitmq) - macro: rook_writing_conf condition: (proc.name=toolbox.sh and container.image startswith rook/toolbox and fd.directory=/etc/ceph) - macro: httpd_writing_conf_logs condition: (proc.name=httpd and fd.name startswith /etc/httpd/) - macro: mysql_writing_conf condition: > ((proc.name in (start-mysql.sh, run-mysqld) or proc.pname=start-mysql.sh) and (fd.name startswith /etc/mysql or fd.directory=/etc/my.cnf.d)) - macro: redis_writing_conf condition: > (proc.name in (run-redis, redis-launcher.) and fd.name=/etc/redis.conf or fd.name startswith /etc/redis) - macro: openvpn_writing_conf condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn) - macro: php_handlers_writing_conf condition: (proc.name=php_handlers_co and fd.name=/etc/psa/php_versions.json) - macro: sed_writing_temp_file condition: > ((proc.aname[3]=cron_start.sh and fd.name startswith /etc/security/sed) or (proc.name=sed and (fd.name startswith /etc/apt/sources.list.d/sed or fd.name startswith /etc/apt/sed or fd.name startswith /etc/apt/apt.conf.d/sed))) - macro: cron_start_writing_pam_env condition: (proc.cmdline="bash /usr/sbin/start-cron" and fd.name=/etc/security/pam_env.conf) - macro: dpkg_scripting condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu)) - macro: user_known_write_etc_conditions condition: proc.name=confd - macro: write_etc_common condition: > etc_dir and evt.dir = < and open_write and proc_name_exists and not proc.name in (passwd_binaries, shadowutils_binaries, sysdigcloud_binaries, package_mgmt_binaries, ssl_mgmt_binaries, dhcp_binaries, dev_creation_binaries, shell_mgmt_binaries, mail_config_binaries, sshkit_script_binaries, ldconfig.real, ldconfig, confd, gpg, insserv, apparmor_parser, update-mime, tzdata.config, tzdata.postinst, systemd, systemd-machine, systemd-sysuser, debconf-show, rollerd, bind9.postinst, sv, gen_resolvconf., update-ca-certi, certbot, runsv, qualys-cloud-ag, locales.postins, nomachine_binaries, adclient, certutil, crlutil, pam-auth-update, parallels_insta, openshift-launc, update-rc.d) and not proc.pname in (sysdigcloud_binaries, mail_config_binaries, hddtemp.postins, sshkit_script_binaries, locales.postins, deb_binaries, dhcp_binaries) and not fd.name pmatch (safe_etc_dirs) and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc) and not sed_temporary_file and not exe_running_docker_save and not ansible_running_python and not python_running_denyhosts and not fluentd_writing_conf_files and not user_known_write_etc_conditions and not run_by_centrify and not run_by_adclient and not qualys_writing_conf_files and not git_writing_nssdb and not plesk_writing_keys and not plesk_install_writing_apache_conf and not plesk_running_mktemp and not networkmanager_writing_resolv_conf and not run_by_chef and not add_shell_writing_shells_tmp and not duply_writing_exclude_files and not xmlcatalog_writing_files and not parent_supervise_running_multilog and not supervise_writing_status and not pki_realm_writing_realms and not htpasswd_writing_passwd and not lvprogs_writing_conf and not ovsdb_writing_openvswitch and not datadog_writing_conf and not curl_writing_pki_db and not haproxy_writing_conf and not java_writing_conf and not dpkg_scripting and not parent_ucf_writing_conf and not rabbitmq_writing_conf and not rook_writing_conf and not php_handlers_writing_conf and not sed_writing_temp_file and not cron_start_writing_pam_env and not httpd_writing_conf_logs and not mysql_writing_conf and not openvpn_writing_conf and not consul_template_writing_conf and not countly_writing_nginx_conf and not ms_oms_writing_conf and not ms_scx_writing_conf and not azure_scripts_writing_conf and not azure_networkwatcher_writing_conf and not couchdb_writing_conf and not update_texmf_writing_conf and not slapadd_writing_conf and not symantec_writing_conf and not liveupdate_writing_conf and not sosreport_writing_files and not selinux_writing_conf and not veritas_writing_config and not nginx_writing_conf and not nginx_writing_certs and not chef_client_writing_conf and not centrify_writing_krb and not cockpit_writing_conf and not ipsec_writing_conf and not httpd_writing_ssl_conf and not userhelper_writing_etc_security and not pkgmgmt_progs_writing_pki and not update_ca_trust_writing_pki and not brandbot_writing_os_release and not redis_writing_conf and not openldap_writing_conf and not ucpagent_writing_conf and not iscsi_writing_conf - rule: Write below etc desc: an attempt to write to any file below /etc condition: write_etc_common output: "File below /etc opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name program=%proc.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])" priority: ERROR tags: [filesystem] - list: known_root_files items: [/root/.monit.state, /root/.auth_tokens, /root/.bash_history, /root/.ash_history, /root/.aws/credentials, /root/.viminfo.tmp, /root/.lesshst, /root/.bzr.log, /root/.gitconfig.lock, /root/.babel.json, /root/.localstack, /root/.node_repl_history, /root/.mongorc.js, /root/.dbshell, /root/.augeas/history, /root/.rnd, /root/.wget-hsts] - list: known_root_directories items: [/root/.oracle_jre_usage, /root/.ssh, /root/.subversion, /root/.nami] - macro: known_root_conditions condition: (fd.name startswith /root/orcexec. or fd.name startswith /root/.m2 or fd.name startswith /root/.npm or fd.name startswith /root/.pki or fd.name startswith /root/.ivy2 or fd.name startswith /root/.config/Cypress or fd.name startswith /root/.config/pulse or fd.name startswith /root/.config/configstore or fd.name startswith /root/jenkins/workspace or fd.name startswith /root/.jenkins or fd.name startswith /root/.cache or fd.name startswith /root/.sbt or fd.name startswith /root/.java or fd.name startswith /root/.glide or fd.name startswith /root/.sonar or fd.name startswith /root/.v8flag or fd.name startswith /root/infaagent or fd.name startswith /root/.local/lib/python or fd.name startswith /root/.pm2 or fd.name startswith /root/.gnupg or fd.name startswith /root/.pgpass or fd.name startswith /root/.theano or fd.name startswith /root/.gradle or fd.name startswith /root/.android or fd.name startswith /root/.ansible or fd.name startswith /root/.crashlytics or fd.name startswith /root/.dbus or fd.name startswith /root/.composer or fd.name startswith /root/.gconf or fd.name startswith /root/.nv or fd.name startswith /root/.local/share/jupyter or fd.name startswith /root/oradiag_root or fd.name startswith /root/workspace or fd.name startswith /root/jvm or fd.name startswith /root/.node-gyp) - rule: Write below root desc: an attempt to write to any file directly below / or /root condition: > root_dir and evt.dir = < and open_write and not fd.name in (known_root_files) and not fd.directory in (known_root_directories) and not exe_running_docker_save and not gugent_writing_guestagent_log and not dse_writing_tmp and not zap_writing_state and not airflow_writing_state and not rpm_writing_root_rpmdb and not maven_writing_groovy and not known_root_conditions output: "File below / or /root opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname file=%fd.name program=%proc.name)" priority: ERROR tags: [filesystem] - macro: cmp_cp_by_passwd condition: proc.name in (cmp, cp) and proc.pname in (passwd, run-parts) - rule: Read sensitive file trusted after startup desc: > an attempt to read any sensitive file (e.g. files containing user/password/authentication information) by a trusted program after startup. Trusted programs might read these files at startup to load initial state, but not afterwards. condition: sensitive_files and open_read and server_procs and not proc_is_new and proc.name!="sshd" output: > Sensitive file opened for reading by trusted program after startup (user=%user.name command=%proc.cmdline parent=%proc.pname file=%fd.name parent=%proc.pname gparent=%proc.aname[2]) priority: WARNING tags: [filesystem] - list: read_sensitive_file_binaries items: [ iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd, vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update, pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport, scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd ] - macro: user_read_sensitive_file_conditions condition: cmp_cp_by_passwd - rule: Read sensitive file untrusted desc: > an attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs. condition: > sensitive_files and open_read and proc_name_exists and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries, cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries, vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries, in.proftpd, mandb, salt-minion, postgres_mgmt_binaries) and not cmp_cp_by_passwd and not ansible_running_python and not proc.cmdline contains /usr/bin/mandb and not run_by_qualys and not run_by_chef and not user_read_sensitive_file_conditions and not perl_running_plesk and not perl_running_updmap and not veritas_driver_script and not perl_running_centrifydc output: > Sensitive file opened for reading by non-trusted program (user=%user.name program=%proc.name command=%proc.cmdline file=%fd.name parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]) priority: WARNING tags: [filesystem] - rule: Write below rpm database desc: an attempt to write to the rpm database by any non-rpm related program condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef output: "Rpm database opened for writing by a non-rpm program (command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline)" priority: ERROR tags: [filesystem, software_mgmt] - macro: postgres_running_wal_e condition: (proc.pname=postgres and proc.cmdline startswith "sh -c envdir /etc/wal-e.d/env /usr/local/bin/wal-e") - macro: redis_running_prepost_scripts condition: (proc.aname[2]=redis-server and (proc.cmdline contains "redis-server.post-up.d" or proc.cmdline contains "redis-server.pre-up.d")) - macro: rabbitmq_running_scripts condition: > (proc.pname=beam.smp and (proc.cmdline startswith "sh -c exec ps" or proc.cmdline startswith "sh -c exec inet_gethost" or proc.cmdline= "sh -s unix:cmd" or proc.cmdline= "sh -c exec /bin/sh -s unix:cmd 2>&1")) - macro: rabbitmqctl_running_scripts condition: (proc.aname[2]=rabbitmqctl and proc.cmdline startswith "sh -c ") - macro: run_by_appdynamics condition: (proc.pname=java and proc.pcmdline startswith "java -jar -Dappdynamics") - rule: DB program spawned process desc: > a database-server related program spawned a new process other than itself. This shouldn\'t occur and is a follow on from some SQL injection attacks. condition: > proc.pname in (db_server_binaries) and spawned_process and not proc.name in (db_server_binaries) and not postgres_running_wal_e output: > Database-related program spawned process other than itself (user=%user.name program=%proc.cmdline parent=%proc.pname) priority: NOTICE tags: [process, database] - rule: Modify binary dirs desc: an attempt to modify any file below a set of binary directories. condition: (bin_dir_rename) and modify and not package_mgmt_procs and not exe_running_docker_save output: > File below known binary directory renamed/removed (user=%user.name command=%proc.cmdline pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args) priority: ERROR tags: [filesystem] - rule: Mkdir binary dirs desc: an attempt to create a directory below a set of binary directories. condition: mkdir and bin_dir_mkdir and not package_mgmt_procs output: > Directory below known binary directory created (user=%user.name command=%proc.cmdline directory=%evt.arg.path) priority: ERROR tags: [filesystem] - list: user_known_change_thread_namespace_binaries items: [] - rule: Change thread namespace desc: > an attempt to change a program/thread\'s namespace (commonly done as a part of creating a container) by calling setns. condition: > evt.type = setns and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter) and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name startswith "runc:" and not proc.pname in (sysdigcloud_binaries) and not java_running_sdjagent and not kubelet_running_loopback output: > Namespace change (setns) by unexpected program (user=%user.name command=%proc.cmdline parent=%proc.pname %container.info) priority: NOTICE tags: [process] - list: protected_shell_spawning_binaries items: [ http_server_binaries, db_server_binaries, nosql_server_binaries, mail_binaries, fluentd, flanneld, splunkd, consul, smbd, runsv, PM2 ] - macro: parent_java_running_zookeeper condition: (proc.pname=java and proc.pcmdline contains org.apache.zookeeper.server) - macro: parent_java_running_kafka condition: (proc.pname=java and proc.pcmdline contains kafka.Kafka) - macro: parent_java_running_elasticsearch condition: (proc.pname=java and proc.pcmdline contains org.elasticsearch.bootstrap.Elasticsearch) - macro: parent_java_running_activemq condition: (proc.pname=java and proc.pcmdline contains activemq.jar) - macro: parent_java_running_cassandra condition: (proc.pname=java and (proc.pcmdline contains "-Dcassandra.config.loader" or proc.pcmdline contains org.apache.cassandra.service.CassandraDaemon)) - macro: parent_java_running_jboss_wildfly condition: (proc.pname=java and proc.pcmdline contains org.jboss) - macro: parent_java_running_glassfish condition: (proc.pname=java and proc.pcmdline contains com.sun.enterprise.glassfish) - macro: parent_java_running_hadoop condition: (proc.pname=java and proc.pcmdline contains org.apache.hadoop) - macro: parent_java_running_datastax condition: (proc.pname=java and proc.pcmdline contains com.datastax) - macro: nginx_starting_nginx condition: (proc.pname=nginx and proc.cmdline contains "/usr/sbin/nginx -c /etc/nginx/nginx.conf") - macro: nginx_running_aws_s3_cp condition: (proc.pname=nginx and proc.cmdline startswith "sh -c /usr/local/bin/aws s3 cp") - macro: consul_running_net_scripts condition: (proc.pname=consul and (proc.cmdline startswith "sh -c curl" or proc.cmdline startswith "sh -c nc")) - macro: consul_running_alert_checks condition: (proc.pname=consul and proc.cmdline startswith "sh -c /bin/consul-alerts") - macro: serf_script condition: (proc.cmdline startswith "sh -c serf") - macro: check_process_status condition: (proc.cmdline startswith "sh -c kill -0 ") - macro: possibly_node_in_container condition: (never_true and (proc.pname=node and proc.aname[3]=docker-containe)) - macro: possibly_parent_java_running_tomcat condition: (never_true and proc.pname=java and proc.pcmdline contains org.apache.catalina.startup.Bootstrap) - macro: protected_shell_spawner condition: > (proc.aname in (protected_shell_spawning_binaries) or parent_java_running_zookeeper or parent_java_running_kafka or parent_java_running_elasticsearch or parent_java_running_activemq or parent_java_running_cassandra or parent_java_running_jboss_wildfly or parent_java_running_glassfish or parent_java_running_hadoop or parent_java_running_datastax or possibly_parent_java_running_tomcat or possibly_node_in_container) - list: mesos_shell_binaries items: [mesos-docker-ex, mesos-slave, mesos-health-ch] - rule: Run shell untrusted desc: an attempt to spawn a shell below a non-shell application. Specific applications are monitored. condition: > spawned_process and shell_procs and proc.pname exists and protected_shell_spawner and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries, needrestart_binaries, mesos_shell_binaries, erl_child_setup, exechealthz, PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf, lb-controller, nvidia-installe, runsv, statsite, erlexec) and not proc.cmdline in (known_shell_spawn_cmdlines) and not proc.aname in (unicorn_launche) and not consul_running_net_scripts and not consul_running_alert_checks and not nginx_starting_nginx and not nginx_running_aws_s3_cp and not run_by_package_mgmt_binaries and not serf_script and not check_process_status and not run_by_foreman and not python_mesos_marathon_scripting and not splunk_running_forwarder and not postgres_running_wal_e and not redis_running_prepost_scripts and not rabbitmq_running_scripts and not rabbitmqctl_running_scripts and not run_by_appdynamics and not user_shell_container_exclusions output: > Shell spawned by untrusted binary (user=%user.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7]) priority: DEBUG tags: [shell] - macro: trusted_containers condition: (container.image startswith sysdig/agent or (container.image startswith sysdig/falco and not container.image startswith sysdig/falco-event-generator) or container.image startswith quay.io/sysdig or container.image startswith sysdig/sysdig or container.image startswith gcr.io/google_containers/hyperkube or container.image startswith quay.io/coreos/flannel or container.image startswith gcr.io/google_containers/kube-proxy or container.image startswith calico/node or container.image startswith rook/toolbox or container.image startswith registry.access.redhat.com/openshift3/logging-fluentd or container.image startswith registry.access.redhat.com/openshift3/logging-elasticsearch or container.image startswith registry.access.redhat.com/openshift3/metrics-cassandra or container.image startswith openshift3/ose-sti-builder or container.image startswith registry.access.redhat.com/openshift3/ose-sti-builder or container.image startswith registry.access.redhat.com/openshift3/ose-docker-builder or container.image startswith registry.access.redhat.com/openshift3/image-inspector or container.image startswith cloudnativelabs/kube-router or container.image startswith "consul:" or container.image startswith mesosphere/mesos-slave or container.image startswith istio/proxy_ or container.image startswith datadog/docker-dd-agent or container.image startswith datadog/agent or container.image startswith docker/ucp-agent or container.image startswith gliderlabs/logspout) - macro: user_trusted_containers condition: (container.image startswith sysdig/agent) - macro: user_sensitive_mount_containers condition: (container.image startswith sysdig/agent) - rule: Launch Privileged Container desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images. condition: > evt.type=execve and proc.vpid=1 and container and container.privileged=true and not trusted_containers and not user_trusted_containers output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image) priority: INFO tags: [container, cis] - macro: sensitive_mount condition: (container.mount.dest[/proc*] != "N/A" or container.mount.dest[/var/run/docker.sock] != "N/A" or container.mount.dest[/] != "N/A" or container.mount.dest[/etc] != "N/A" or container.mount.dest[/root*] != "N/A") - macro: container_entrypoint condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe)) - rule: Launch Sensitive Mount Container desc: > Detect the initial process started by a container that has a mount from a sensitive host directory (i.e. /proc). Exceptions are made for known trusted images. condition: > evt.type=execve and proc.vpid=1 and container and sensitive_mount and not trusted_containers and not user_sensitive_mount_containers output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image mounts=%container.mounts) priority: INFO tags: [container, cis] - macro: allowed_containers condition: (proc.vpid=1) - rule: Launch Disallowed Container desc: > Detect the initial process started by a container that is not in a list of allowed containers. condition: evt.type=execve and proc.vpid=1 and container and not allowed_containers output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image) priority: WARNING tags: [container] - rule: System user interactive desc: an attempt to run interactive commands by a system (i.e. non-login) user condition: spawned_process and system_users and interactive output: "System user ran an interactive command (user=%user.name command=%proc.cmdline)" priority: INFO tags: [users] - rule: Terminal shell in container desc: A shell was used as the entrypoint/exec point into a container with an attached terminal. condition: > spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint output: > A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty) priority: NOTICE tags: [container, shell] - list: known_shell_spawn_cmdlines items: [ '"sh -c uname -p 2> /dev/null"', '"sh -c uname -s 2>&1"', '"sh -c uname -r 2>&1"', '"sh -c uname -v 2>&1"', '"sh -c uname -a 2>&1"', '"sh -c ruby -v 2>&1"', '"sh -c getconf CLK_TCK"', '"sh -c getconf PAGESIZE"', '"sh -c LC_ALL=C LANG=C /sbin/ldconfig -p 2>/dev/null"', '"sh -c LANG=C /sbin/ldconfig -p 2>/dev/null"', '"sh -c /sbin/ldconfig -p 2>/dev/null"', '"sh -c stty -a 2>/dev/null"', '"sh -c stty -a < /dev/tty"', '"sh -c stty -g < /dev/tty"', '"sh -c node index.js"', '"sh -c node index"', '"sh -c node ./src/start.js"', '"sh -c node app.js"', '"sh -c node -e \"require(''nan'')\""', '"sh -c node -e \"require(''nan'')\")"', '"sh -c node $NODE_DEBUG_OPTION index.js "', '"sh -c crontab -l 2"', '"sh -c lsb_release -a"', '"sh -c lsb_release -is 2>/dev/null"', '"sh -c whoami"', '"sh -c node_modules/.bin/bower-installer"', '"sh -c /bin/hostname -f 2> /dev/null"', '"sh -c locale -a"', '"sh -c -t -i"', '"sh -c openssl version"', '"bash -c id -Gn kafadmin"', '"sh -c /bin/sh -c ''date +%%s''"' ] - list: user_known_shell_spawn_binaries items: [] - macro: user_shell_container_exclusions condition: (never_true) - macro: login_doing_dns_lookup condition: (proc.name=login and fd.l4proto=udp and fd.sport=53) - rule: System procs network activity desc: any network activity performed by system binaries that are not expected to send or receive any network traffic condition: > (fd.sockfamily = ip and system_procs) and (inbound_outbound) and not proc.name in (systemd, hostid, id) and not login_doing_dns_lookup output: > Known system binary sent/received network traffic (user=%user.name command=%proc.cmdline connection=%fd.name) priority: NOTICE tags: [network] - list: openvpn_udp_ports items: [1194, 1197, 1198, 8080, 9201] - list: l2tp_udp_ports items: [500, 1701, 4500, 10000] - list: statsd_ports items: [8125] - list: ntp_ports items: [123] - list: test_connect_ports items: [0, 9, 80, 3306] - macro: do_unexpected_udp_check condition: (never_true) - list: expected_udp_ports items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports] - macro: expected_udp_traffic condition: fd.port in (expected_udp_ports) - rule: Unexpected UDP Traffic desc: UDP traffic not on port 53 (DNS) or other commonly used ports condition: (inbound_outbound) and do_unexpected_udp_check and fd.l4proto=udp and not expected_udp_traffic output: > Unexpected UDP Traffic Seen (user=%user.name command=%proc.cmdline connection=%fd.name proto=%fd.l4proto evt=%evt.type %evt.args) priority: NOTICE tags: [network] - macro: somebody_becoming_themself condition: ((user.name=nobody and evt.arg.uid=nobody) or (user.name=www-data and evt.arg.uid=www-data) or (user.name=_apt and evt.arg.uid=_apt) or (user.name=postfix and evt.arg.uid=postfix) or (user.name=pki-agent and evt.arg.uid=pki-agent) or (user.name=pki-acme and evt.arg.uid=pki-acme) or (user.name=nfsnobody and evt.arg.uid=nfsnobody) or (user.name=postgres and evt.arg.uid=postgres)) - macro: nrpe_becoming_nagios condition: (proc.name=nrpe and evt.arg.uid=nagios) - macro: known_user_in_container condition: (container and user.name != "N/A") - rule: Non sudo setuid desc: > an attempt to change users by calling setuid. sudo/su are excluded. users "root" and "nobody" suing to itself are also excluded, as setuid calls typically involve dropping privileges. condition: > evt.type=setuid and evt.dir=> and (known_user_in_container or not container) and not user.name=root and not somebody_becoming_themself and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries, nomachine_binaries) and not java_running_sdjagent and not nrpe_becoming_nagios output: > Unexpected setuid call by non-sudo, non-root program (user=%user.name cur_uid=%user.uid parent=%proc.pname command=%proc.cmdline uid=%evt.arg.uid) priority: NOTICE tags: [users] - rule: User mgmt binaries desc: > activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded. Activity in containers is also excluded--some containers create custom users on top of a base linux distribution at startup. Some innocuous commandlines that don't actually change anything are excluded. condition: > spawned_process and proc.name in (user_mgmt_binaries) and not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not container and not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and not proc.cmdline startswith "passwd -S" and not proc.cmdline startswith "useradd -D" and not proc.cmdline startswith "systemd --version" and not run_by_qualys and not run_by_sumologic_securefiles and not run_by_yum and not run_by_ms_oms and not run_by_google_accounts_daemon output: > User management binary command run outside of container (user=%user.name command=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]) priority: NOTICE tags: [host, users] - list: allowed_dev_files items: [ /dev/null, /dev/stdin, /dev/stdout, /dev/stderr, /dev/random, /dev/urandom, /dev/console, /dev/kmsg ] - rule: Create files below dev desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev. condition: > fd.directory = /dev and (evt.type = creat or (evt.type = open and evt.arg.flags contains O_CREAT)) and not proc.name in (dev_creation_binaries) and not fd.name in (allowed_dev_files) and not fd.name startswith /dev/tty output: "File created below /dev by untrusted program (user=%user.name command=%proc.cmdline file=%fd.name)" priority: ERROR tags: [filesystem] - macro: ec2_metadata_containers condition: container - rule: Contact EC2 Instance Metadata Service From Container desc: Detect attempts to contact the EC2 Instance Metadata Service from a container condition: outbound and fd.sip="169.254.169.254" and container and not ec2_metadata_containers output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image) priority: NOTICE tags: [network, aws, container] - macro: k8s_api_server condition: (fd.sip="1.2.3.4" and fd.sport=8080) - macro: k8s_containers condition: > (container.image startswith gcr.io/google_containers/hyperkube-amd64 or container.image startswith gcr.io/google_containers/kube2sky or container.image startswith sysdig/agent or container.image startswith sysdig/falco or container.image startswith sysdig/sysdig) - rule: Contact K8S API Server From Container desc: Detect attempts to contact the K8S API Server from a container condition: outbound and k8s_api_server and container and not k8s_containers output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image connection=%fd.name) priority: NOTICE tags: [network, k8s, container] - macro: nodeport_containers condition: container - rule: Unexpected K8s NodePort Connection desc: Detect attempts to use K8s NodePorts from a container condition: (inbound_outbound) and fd.sport >= 30000 and fd.sport <= 32767 and container and not nodeport_containers output: Unexpected K8s NodePort Connection (command=%proc.cmdline connection=%fd.name) priority: NOTICE tags: [network, k8s, container] falco_rules_local: | #################### # Your custom rules! #################### # Add new rules, like this one # - rule: The program "sudo" is run in a container # desc: An event will trigger every time you run sudo in a container # condition: evt.type = execve and evt.dir=< and container.id != host and proc.name = sudo # output: "Sudo run in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)" # priority: ERROR # tags: [users, container] # Or override/append to any rule, macro, or list from the Default Rules custom_rules: {} # Although Falco comes with a nice default rule set for detecting weird # behavior in containers, our users are going to customize the run-time # security rule sets or policies for the specific container images and # applications they run. This feature can be handled in this section. # # Example: # # rules-traefik.yaml: |- # [ rule body ] dependencies: dynamic: common: local_image_registry: jobs: - k8sksauth-image-repo-sync services: - endpoint: node service: local_image_registry static: falco: services: null image_repo_sync: services: - endpoint: internal service: local_image_registry manifests: daemonset: true configmap_etc: true configmap_custom_rules: false configmap_bin: true ...