cowWhySo/permission-command-corpus huggingface dataset:
Command: outbound and interpreted_procs
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Interpreted procs outbound network activity
Notes: Any outbound network activity performed by any interpreted program (perl, python, ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing it effectively requires significant time and might result in a moderate level of noise. Suggesting customizing this rule to be more specific. For example, you could set it up to alert only for important namespaces after studying their usual behavior.
Command: inbound_outbound and container and fd.sport >= 30000 and fd.sport <= 32767 and not nodeport_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Unexpected K8s NodePort Connection
Notes: Detect attempts to utilize K8s NodePorts from a container. K8s NodePorts are accessible on the eth0 interface of each node, and they facilitate external traffic into a Kubernetes cluster. Attackers could misuse them for unauthorized access. The rule uses default port ranges, but check for custom ranges and make necessary adjustments. Also, consider tuning this rule as needed.
Command: ((modify and evt.arg.newpath contains "/.") or (mkdir and evt.arg.path contains "/.") or (open_write and evt.arg.flags contains "O_CREAT" and fd.name contains "/." and not fd.name pmatch (exclude_hidden_directories))) and not user_known_create_hidden_file_activities and not exe_running_docker_save
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Create Hidden Files or Directories
Notes: Detecting hidden files or directories creation can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.
Command: net_miner_pool and not trusted_images_query_miner_domain_dns
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Detect outbound connections to common miner pool ports
Notes: Miners usually connect to miner pools using standard ports, and this rule flags such activity. Important: Falco currently sends DNS requests to resolve miner pool domains, which could trigger other alerts. Prior to enabling this rule, it's advised to ensure whether this is acceptable for your environment. This rule is specifically disabled for that reason.
Command: spawned_process and (proc.cmdline contains "stratum+tcp" or proc.cmdline contains "stratum2+tcp" or proc.cmdline contains "stratum+ssl" or proc.cmdline contains "stratum2+ssl")
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Detect crypto miners using the Stratum protocol
Notes: Miners commonly specify the mining pool to connect to using a URI that starts with "stratum+tcp". However, this rule is highly specific to this technique, and matching command-line arguments can generally be bypassed quite easily.
Command: spawned_process and container and not user_known_k8s_client_container_parens and proc.name in (k8s_client_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Kubernetes Client Tool Launched in Container
Notes: Detect the execution of a Kubernetes client tool (like docker, kubectl, crictl) within a container, which is typically not expected behavior. Although this rule targets container workloads, monitoring the use of tools like crictl on the host over interactive access could also be valuable for broader auditing objectives.
Command: chmod and container and evt.rawres>=0 and ((evt.arg.mode contains "S_IXUSR") or (evt.arg.mode contains "S_IXGRP") or (evt.arg.mode contains "S_IXOTH")) and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Container Drift Detected (chmod)
Notes: Detect new executables created within a container as a result of chmod. While this detection can generate significant noise, chmod usage is frequently linked to dropping and executing malicious implants. The newer rule "Drop and execute new binary in container" provides more precise detection of this TTP using unambiguous kernel signals. It is recommended to use the new rule. However, this rule might be more relevant for auditing if applicable in your environment, such as when chmod is used on f
Command: evt.type in (open,openat,openat2,creat) and evt.rawres>=0 and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Container Drift Detected (open+create)
Notes: Detect new executables created within a container as a result of open+create. The newer rule "Drop and execute new binary in container" provides more precise detection of this TTP using unambiguous kernel signals. It is recommended to use the new rule.
Command: spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Container Run as Root User
Notes: Container detected running as the root user. This should be taken into account especially when policies disallow containers from running with root user privileges. Note that a root user in containers doesn't inherently possess extensive power, as modern container environments define privileges through Linux capabilities. To learn more, check out the rule "Launch Privileged Container".
Command: spawned_process and user.uid != 0 and (proc.name=sudoedit or proc.name = sudo) and (proc.args contains -s or proc.args contains -i or proc.args contains --login) and (proc.args contains "\ " or proc.args endswith \)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Sudo Potential Privilege Escalation
Notes: Affecting sudo (<= 1.9.5p2), there's a privilege escalation vulnerability. By executing sudo using the sudoedit -s or sudoedit -i command with a command-line argument that ends with a single backslash character, an unprivileged user can potentially escalate privileges to root. This rule is highly specific and might be bypassed due to potential issues with string matching on command line arguments.
Command: evt.type = userfaultfd and user.uid != 0 and (evt.rawres >= 0 or evt.res != -1) and not proc.name in (user_known_userfaultfd_processes)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Unprivileged Delegation of Page Faults Handling to a Userspace Process
Notes: Detect a successful unprivileged userfaultfd syscall, which could serve as an attack primitive for exploiting other vulnerabilities. To fine-tune this rule, consider using the template list "user_known_userfaultfd_processes".
Command: spawned_process and user.uid != 0 and proc.name=pkexec and proc.args = ''
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
Notes: This rule detects attempts to exploit a privilege escalation vulnerability in Polkit's pkexec. Through the execution of specially crafted code, a local user can exploit this weakness to attain root privileges on a compromised system. This rule is highly specific in its scope.
Command: java_network_read and evt.buffer bcontains cafebabe
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Java Process Class File Download
Notes: Detecting a Java process downloading a class file which could indicate a successful exploit of the log4shell Log4j vulnerability (CVE-2021-44228). This rule is highly specific in its scope.
Command: open_write and container and (fd.name=/proc/self/exe or fd.name startswith /proc/self/fd/) and not docker_procs and not proc.cmdline = "runc:[1:CHILD] init"
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Modify Container Entrypoint
Notes: This rule detect an attempt to write on container entrypoint symlink (/proc/self/exe). Possible CVE-2019-5736 Container Breakout exploitation attempt. This rule has a more narrow scope.
Command: spawned_process and container and base64_decoding and not container.image.repository in (known_decode_payload_containers)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Decoding Payload in Container
Notes: Detect any use of {base64} decoding in a container. Legitimate applications may decode encoded payloads. The template list known_decode_payload_containers can be used for simple tuning and customization, or you can adopt custom, more refined tuning. Less sophisticated adversaries may {base64}-decode their payloads not only to obfuscate them, but also to ensure that the payload remains intact when the application processes it. Note that injecting commands into an application's input often results
Command: spawned_process and recon_binaries_procs and proc.tty != 0 and proc.is_vpgid_leader=true
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Basic Interactive Reconnaissance
Notes: This rule detects basic interactive reconnaissance commands that are typically run by unsophisticated attackers or used in internal Red Team exercises. Interactive is defined as a terminal being present (proc.tty != 0). This could be any form of reverse shell or usage of kubectl exec or ssh etc. In addition, filtering for the process being the process group leader indicates that the command was "directly" typed into the terminal and not run as a result of a script. This rule is a basic auditing
Command: spawned_process and not container and ((proc.name = "nc" and (proc.cmdline contains "-e" or proc.cmdline contains "-c")) or (proc.name = "ncat" and (proc.args contains "--sh-exec" or proc.args contains "--exec" or proc.args contains "-e " or proc.args contains "-c " or proc.args contains "--lua-exec")) or (proc.name = 'socat' and (proc.args contains "EXEC" or proc.args contains "SYSTEM")))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Netcat/Socat Remote Code Execution on Host
Notes: Netcat/Socat Program runs on host that allows remote code execution and may be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/. These programs are of higher relevance as they are commonly installed on UNIX-like operating systems.
Command: spawned_process and container and network_tool_procs and npm_package_install_ancestor and not user_known_network_tool_in_npm_install_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Network Tool Executed During NPM Package Install
Notes: Detect network tools being launched when an NPM package is installed. Malicious NPM packages may invoke  preinstall or postinstall commands, which can involve network tools to download malicious payloads or exfiltrate  sensitive information. Network tools spawned by npm, node, yarn, pnpm, bun, or related processes during  package installation should be investigated. This rule complements the more generic "Launch Suspicious Network  Tool in Container" rule with a specific focus on the supply chai
Command: spawned_process and is_miner_process
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Known Cryptominer Process Executed
Notes: Detects execution of known cryptocurrency mining software by matching process names against a list of common miners. Cryptominers are commonly deployed by attackers after gaining initial access to monetize compromised systems. This rule complements the existing "Detect crypto miners using the Stratum protocol" rule by catching miners that may use renamed binaries but still match known miner process names. Consider tuning this rule if you have legitimate mining operations in your environment.
Command: spawned_process and spawned_by_web_server and proc.name in (shell_binaries) and not proc.cmdline startswith "sh -c /usr/bin" and not proc.cmdline contains "healthcheck" and not user_known_web_server_shell_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Web Server Spawned Shell
Notes: Detects a web server process (nginx, apache, php-fpm, etc.) spawning an interactive shell. This is a strong indicator of webshell exploitation or remote code execution vulnerability being actively exploited. Webshells are a common persistence mechanism used by attackers after compromising web applications. The macro user_known_web_server_shell_activities can be overridden to tune for legitimate use cases like CGI scripts. Note that simple shell wrappers used in health checks are excluded.
Command: spawned_process and spawned_by_web_server and proc.name in (suspicious_web_children) and not proc.name in (shell_binaries) and not proc.cmdline contains "healthcheck" and not proc.cmdline contains "status" and not user_known_web_server_child_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Web Server Spawned Suspicious Child Process
Notes: Detects web server processes spawning suspicious child processes like curl, wget, netcat, or scripting interpreters. These often indicate exploitation of web application vulnerabilities, where attackers download additional payloads or establish network connections. This rule is more sensitive than the shell spawning rule and may require tuning in environments where web applications legitimately execute system commands. Override the macro user_known_web_server_child_activities for custom tuning.
Command: spawned_process and spawned_by_web_server and (proc.cmdline contains "/dev/tcp/" or proc.cmdline contains "nc -e" or proc.cmdline contains "ncat -e" or proc.cmdline contains "bash -i" or proc.cmdline contains "python -c 'import socket" or proc.cmdline contains "python3 -c 'import socket" or proc.cmdline contains "perl -e 'use Socket" or proc.cmdline contains "ruby -rsocket" or (proc.cmdline contains "mkfifo" and proc.cmdline contains "/tmp"))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Reverse Shell from Web Server
Notes: Detects common reverse shell patterns spawned from web server processes. Attackers frequently establish reverse shells after exploiting web vulnerabilities to maintain interactive access to the compromised system. This rule looks for specific command patterns known to create reverse shells, including bash /dev/tcp redirects, netcat with -e flag, and common scripting language reverse shell idioms.
Command: (open_read or open_write) and container and (fd.name startswith /dev/sd or fd.name startswith /dev/nvme or fd.name startswith /dev/vd or fd.name startswith /dev/xvd or fd.name = /dev/mem or fd.name = /dev/kmem) and not user_known_privileged_device_access
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Privileged Container Device Access
Notes: Detects container processes accessing raw block devices, which could be used to escape container isolation by directly reading or writing to host storage. This technique allows attackers to access the host filesystem, modify system files, or extract sensitive data even without traditional container escape. Requires the container to have privileged access or specific device permissions. Override user_known_privileged_device_access for legitimate storage operations.
Command: (open_read or open_write) and container and (fd.name startswith /host/ or fd.name startswith /rootfs/ or fd.name startswith /hostfs/) and not known_container_runtime_host_access and not user_known_host_path_access
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Container Access to Host Sensitive Paths
Notes: Detects container processes accessing paths that typically only exist when the host filesystem is mounted into the container (like /host, /rootfs, /hostfs). This may indicate a container escape attempt or a misconfigured volume mount that exposes the host filesystem. Legitimate monitoring or backup containers may access these paths, so tune accordingly using the user_known_host_path_access macro.
Command: (open_read or open_file_failed) and (etc_dir or user_ssh_directory or fd.name startswith /root/.ssh or fd.name contains "id_rsa") and directory_traversal and not proc.pname in (shell_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Directory traversal monitored file read
Notes: Web applications can be vulnerable to directory traversal attacks that allow accessing files outside of the web app's root directory (e.g. Arbitrary File Read bugs). System directories like /etc are typically accessed via absolute paths. Access patterns outside of this (here path traversal) can be regarded as suspicious. This rule includes failed file open attempts.
Command: open_read and sensitive_files and server_procs and not proc_is_new and proc.name!="sshd" and not user_known_read_sensitive_files_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Read sensitive file trusted after startup
Notes: An attempt to read any sensitive file (e.g. files containing user/password/authentication information) by a trusted program after startup. Trusted programs might read these files at startup to load initial state, but not afterwards. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credent
Command: open_read and sensitive_files and proc_name_exists and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries, cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries, vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries, in.proftpd, mandb, salt-call, salt-minion, postgres_mgmt_binaries, google_oslogin_ ) and not cmp_cp_by_passwd and not ansible_running_python and not run_by_qualys and not run_by_chef and not run_by_google_accounts_daemon and not user_read_sensitive_file_conditions and not mandb_postinst and not perl_running_plesk and not perl_running_updmap and not veritas_driver_script and not perl_running_centrifydc and not runuser_reading_pam and not linux_bench_reading_etc_shadow and not user_known_read_sensitive_files_activities and not user_read_sensitive_file_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Read sensitive file untrusted
Notes: An attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rule
Command: spawned_process and shell_procs and proc.pname exists and protected_shell_spawner and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries, needrestart_binaries, mesos_shell_binaries, erl_child_setup, exechealthz, PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf, lb-controller, nvidia-installe, runsv, statsite, erlexec, calico-node, "puma reactor") and not proc.cmdline in (known_shell_spawn_cmdlines) and not proc.aname in (unicorn_launche) and not consul_running_net_scripts and not consul_running_alert_checks and not nginx_starting_nginx and not nginx_running_aws_s3_cp and not run_by_package_mgmt_binaries and not serf_script and not check_process_status and not run_by_foreman and not python_mesos_marathon_scripting and not splunk_running_forwarder and not postgres_running_wal_e and not postgres_running_cnpg and not redis_running_prepost_scripts and not rabbitmq_running_scripts and not rabbitmqctl_running_scripts and not run_by_appdynamics and not user_shell_container_exclusions
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Run shell untrusted
Notes: An attempt to spawn a shell below a non-shell application. The non-shell applications that are monitored are defined in the protected_shell_spawner macro, with protected_shell_spawning_binaries being the list you can easily customize. For Java parent processes, please note that Java often has a custom process name. Therefore, rely more on proc.exe to define Java applications. This rule can be noisier, as you can see in the exhaustive existing tuning. However, given it is very behavior-driven and
Command: spawned_process and system_users and interactive and not user_known_system_user_login
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: System user interactive
Notes: System (e.g. non-login) users spawning new processes. Can add custom service users (e.g. apache or mysqld). 'Interactive' is defined as new processes as descendants of an ssh session or login process. Consider further tuning by only looking at processes in a terminal / tty (proc.tty != 0). A newer field proc.is_vpgid_leader could be of help to distinguish if the process was "directly" executed, for instance, in a tty, or executed as a descendant process in the same process group, which, for exam
Command: spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint and not user_expected_terminal_shell_in_container_conditions
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Terminal shell in container
Notes: A shell was used as the entrypoint/exec point into a container with an attached terminal. Parent process may have legitimately already exited and be null (read container_entrypoint macro). Common when using "kubectl exec" in Kubernetes. Correlate with k8saudit exec logs if possible to find user or serviceaccount token used (fuzzy correlation by namespace and pod name). Rather than considering it a standalone rule, it may be best used as generic auditing rule while examining other triggered rules