cowWhySo/permission-command-corpus huggingface dataset:
Command: evt.type=setuid and (known_user_in_container or not container) and not (user.name=root or user.uid=0) and not somebody_becoming_themselves and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries, nomachine_binaries) and not proc.name startswith "runc:" and not java_running_sdjagent and not nrpe_becoming_nagios and not user_known_non_sudo_setuid_conditions
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Non sudo setuid
Notes: Detect attempts to change users through the use of setuid, with exceptions for sudo/su. The users "root" and "nobody" using setuid on themselves are also excluded, as setuid calls in these cases typically involve reducing privileges. By setting the setuid bit, an attacker could execute code in a different user's context, potentially with higher privileges. One drawback is the potential for noise, as many applications legitimately use this approach.
Command: spawned_process and not container and proc.name in (user_mgmt_binaries) and not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and not proc.cmdline startswith "passwd -S" and not proc.cmdline startswith "useradd -D" and not proc.cmdline startswith "systemd --version" and not run_by_qualys and not run_by_sumologic_securefiles and not run_by_yum and not run_by_ms_oms and not run_by_google_accounts_daemon and not chage_list and not user_known_user_management_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: User mgmt binaries
Notes: Detect activity by any programs that can manage users, passwords, or permissions (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). sudo and su are excluded. Activity in containers is also excluded -- some containers create custom users on top of a base linux distribution at startup. Some innocuous command lines that don't actually change anything are excluded. You might want to consider applying this rule to container actions as well.
Command: (evt.type = creat or (evt.type in (open,openat,openat2))) and evt.arg.flags contains O_CREAT and fd.directory = /dev and not proc.name in (dev_creation_binaries) and not fd.name in (allowed_dev_files) and not fd.name startswith /dev/tty and not user_known_create_files_below_dev_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Create files below dev
Notes: Detect the creation of files under /dev except for authorized device management programs. This can reveal rootkits hiding files in /dev. Additionally, consider the "Execution from /dev/shm" rule. The upstream rule already covers some tuning scenarios that you can further expand upon.
Command: outbound and container and fd.sip="169.254.169.254" and not ec2_metadata_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Contact EC2 Instance Metadata Service From Container
Notes: Detects attempts to communicate with the EC2 Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.
Command: outbound and container and fd.sip="169.254.169.254" and not user_known_metadata_access
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Contact cloud metadata service from container
Notes: Detects attempts to communicate with the Cloud Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.
Command: spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs and not user_known_package_manager_in_container and not pkg_mgmt_in_kube_proxy
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Package Management Process in Container
Notes: Detect package management processes executed within containers. An excellent auditing rule to monitor general drifts in containers. Particularly useful for newer rules like "Drop and execute new binary in container" during incident response investigations. This helps identify common anti-patterns of ad-hoc debugging. Simultaneously, to maintain optimal hygiene, it's recommended to prevent container drifts and instead opt for redeploying new containers.
Command: spawned_process and container and network_tool_procs and not user_known_network_tool_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Suspicious Network Tool in Container
Notes: Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. This rule complements the more specific "Netcat Remote Code Execution in Container" rule.
Command: spawned_process and not container and network_tool_procs and not user_known_network_tool_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Suspicious Network Tool on Host
Notes: Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. The host equivalent of "Launch Suspicious Network Tool in Container.".
Command: (modify_shell_history or truncate_shell_history) and not var_lib_docker_filepath and not proc.name in (docker_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Delete or rename shell history
Notes: Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. Note that it can also trigger when exiting a Terminal shell, such as with `kubectl exec`, which may introduce some noise.
Command: chmod and (evt.arg.mode contains "S_ISUID" or evt.arg.mode contains "S_ISGID") and not proc.name in (user_known_chmod_applications) and not exe_running_docker_save and not user_known_set_setuid_or_setgid_bit_conditions
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Set Setuid or Setgid bit
Notes: This rule is focused on detecting the use of setuid or setgid bits set via chmod. These bits, when set for an application, result in the application running with the privileges of the owning user or group. By enabling the setuid or setgid bits, an attacker could run code in a different user's context, possibly with elevated privileges. However, there's a trade-off with noise, given that numerous applications legitimately run chmod. This rule is related to the "Non sudo setuid" rule.
Command: spawned_process and container and remote_file_copy_procs and not user_known_remote_file_copy_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Remote File Copy Tools in Container
Notes: Detect remote file copy tools (like rsync, scp, sftp, dcp) launched within a container, potentially indicating data exfiltration. Suggest refining this rule to accommodate legitimate use cases.
Command: inbound_outbound and container and k8s.ns.name in (namespace_scope_network_only_subnet) and not network_local_subnet
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Network Connection outside Local Subnet
Notes: Detect network traffic (inbound or outbound) from a container to a destination outside the local subnet. To operationalize this rule, profile your environment and update the template macro namespace_scope_network_only_subnet. Customizing network-related rules usually demands substantial engineering effort to ensure their functionality.
Command: spawned_process and container and container.privileged=true and proc.name=mount and not mount_info and not known_gke_mount_in_privileged_containers and not known_aks_mount_in_privileged_containers and not known_eks_mount_in_privileged_containers and not user_known_mount_in_privileged_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Mount Launched in Privileged Container
Notes: Detect filesystem mounts (using the mount binary) within a privileged container. Due to the elevated privileges, this action could be one of the TTPs used in an attempt to escape from a container to the host. This type of action is often preceded by reconnaissance activities, for which you can also create custom rules.
Command: spawned_process and container and (ingress_remote_file_copy_procs or curl_download) and not user_known_ingress_remote_file_copy_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Ingress Remote File Copy Tools in Container
Notes: Detect ingress remote file copy tools (such as curl or wget) launched inside containers. This rule can be considered a valuable auditing tool, but it has the potential to generate notable noise and requires careful profiling before full operationalization.
Command: open_read and container and (fd.name glob /proc/*/environ) and not proc.name in (known_binaries_to_read_environment_variables_from_proc_files)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Read environment variable from /proc files
Notes: An attempt to read process environment variables from /proc files. The consequences are akin to accessing traditional sensitive files, as sensitive data, including secrets, might be stored in environment variables. Understanding your environment, such as identifying critical namespaces, and incorporating extra filtering statements to alert exclusively for those, can enhance the rule's effectiveness.
Command: open_read and container and proc.name=tar and container_entrypoint and proc.tty=0 and not system_level_side_effect_artifacts_kubectl_cp
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Exfiltrating Artifacts via Kubernetes Control Plane
Notes: Detect the copying of artifacts from a container's file system using the Kubernetes control plane (kubectl cp). This rule can identify potential exfiltration of application secrets from containers' file systems, potentially revealing the outcomes of unauthorized access and control plane misuse via stolen identities (such as stolen credentials like Kubernetes serviceaccount tokens). Can be customized by the adopter to only monitor specific artifact paths, containers, or namespaces as needed.
Command: open_write and (user_ssh_directory or fd.name startswith /root/.ssh) and fd.name endswith authorized_keys and not proc.name in (ssh_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Adding ssh keys to authorized_keys
Notes: After gaining access, attackers can modify the authorized_keys file to maintain persistence on a victim host. Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. This rules aims at detecting any modification to the authorized_keys file, that is usually located under the .ssh directory in any user's home directory. This rule complements the mor
Command: spawned_process and glibc_tunables_env
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Potential Local Privilege Escalation via Environment Variables Misuse
Notes: Process run with suspect environment variable that could be attempting privilege escalation. One use case is detecting the use of the GLIBC_TUNABLES environment variable, which could be used for privilege escalation on systems running vulnerable glibc versions. Only known and carefully profiled processes that legitimately exhibit this behavior should be excluded from this rule. This rule is expected to trigger on every attempt, even failed ones.
Command: open_read and proc.name=sshd and (fd.name contains "liblzma.so.5.6.0" or fd.name contains "liblzma.so.5.6.1")
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Backdoored library loaded into SSHD (CVE-2024-3094)
Notes: This rule detects possible CVE-2024-3094 exploitation when the SSH daemon process loads a vulnerable version of the liblzma library. An attacker could exploit this to interfere with authentication in sshd via systemd, potentially compromising sensitive data or escalating their privileges.
Command: evt.type=bpf and (evt.arg.cmd=5 or evt.arg.cmd=BPF_PROG_LOAD) and not bpf_profiled_procs
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: BPF Program Not Profiled
Notes: BPF is a kernel technology that can be misused for malicious purposes, like "Linux Kernel Module Injection". This rule should be considered an auditing rule to notify you of any unprofiled BPF tools running in your environment. However, it requires customization after profiling your environment. BPF-powered agents make bpf syscalls all the time, so this rule only sends logs for BPF_PROG_LOAD calls (bpf cmd=5) in the enter event. If you also want to log whether the syscall failed or succeeded, re
Command: inbound and not ((fd.cip in (allowed_inbound_source_ipaddrs)) or (fd.cnet in (allowed_inbound_source_networks)) or (fd.cip.name in (allowed_inbound_source_domains)))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Unexpected inbound connection source
Notes: Detect any inbound connection from a source outside of an allowed set of ips, networks, or domain names. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.
Command: open_read and (fd.filename in (shell_config_filenames) or fd.name in (shell_config_files) or fd.directory in (shell_config_directories)) and not proc.name in (shell_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Read Shell Configuration File
Notes: This rule detects attempts made by non-shell programs to read shell configuration files. It offers additional generic auditing. It serves as a baseline detection alert for unusual shell configuration file accesses. The rule "Modify Shell Configuration File" might be more relevant and adequate for your specific cases.
Command: ((open_write and access_repositories) or (modify and modify_repositories)) and not package_mgmt_procs and not package_mgmt_ancestor_procs and not exe_running_docker_save and not user_known_update_package_registry
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Update Package Repository
Notes: This rule generically detects updates to package repositories and can be seen as an auditing measure. Recommend evaluating its relevance for your specific environment.
Command: open_write and bin_dir and not package_mgmt_procs and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms and not user_known_write_below_binary_dir_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Write below binary dir
Notes: Trying to write to any file below specific binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: open_write and monitored_dir and not package_mgmt_procs and not coreos_write_ssh_dir and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms and not google_accounts_daemon_writing_ssh and not cloud_init_writing_ssh and not user_known_write_monitored_dir_conditions
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Write below monitored dir
Notes: Trying to write to any file below a set of monitored directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: write_etc_common
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Write below etc
Notes: Trying to write to any file below /etc can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: open_write and root_dir and proc_name_exists and not fd.name in (known_root_files) and not fd.directory pmatch (known_root_directories) and not exe_running_docker_save and not gugent_writing_guestagent_log and not dse_writing_tmp and not zap_writing_state and not airflow_writing_state and not rpm_writing_root_rpmdb and not maven_writing_groovy and not chef_writing_conf and not kubectl_writing_state and not cassandra_writing_state and not galley_writing_state and not calico_writing_state and not rancher_writing_root and not runc_writing_exec_fifo and not mysqlsh_writing_state and not known_root_conditions and not user_known_write_root_conditions and not user_known_write_below_root_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Write below root
Notes: Trying to write to any file directly below / or /root can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases. Lastly, this rule stands out as potentially the noisiest one among rules relat
Command: open_write and fd.name startswith /var/lib/rpm and not rpm_procs and not ansible_running_python and not python_running_chef and not exe_running_docker_save and not amazon_linux_running_python_yum and not user_known_write_rpm_database_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Write below rpm database
Notes: Trying to write to the rpm database by any non-rpm related program can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: modify and bin_dir_rename and not package_mgmt_procs and not exe_running_docker_save and not user_known_modify_bin_dir_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Modify binary dirs
Notes: Trying to modify any file below a set of binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: mkdir and bin_dir_mkdir and not package_mgmt_procs and not user_known_mkdir_bin_dir_activities and not exe_running_docker_save
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Mkdir binary dirs
Notes: Trying to create a directory below a set of binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: container_started and sensitive_mount and not falco_sensitive_mount_containers and not user_sensitive_mount_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Sensitive Mount Container
Notes: Detect the initial process launched within a container that has a mount from a sensitive host directory (e.g. /proc). Exceptions are made for known trusted images. This rule holds value for generic auditing; however, its noisiness varies based on your environment.
Command: container_started and not allowed_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Disallowed Container
Notes: Detect the initial process launched within a container that is not in a list of allowed containers. This rule holds value for generic auditing; however, this rule requires a good understanding of your setup and consistent effort to keep the list of allowed containers current. In some situations, this can be challenging to manage.
Command: inbound and interpreted_procs
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Interpreted procs inbound network activity
Notes: Any inbound network activity performed by any interpreted program (perl, python, ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing it effectively requires significant time and might result in a moderate level of noise. Suggesting customizing this rule to be more specific. For example, you could set it up to alert only for important namespaces after studying their usual behavior.