cowWhySo/permission-command-corpus huggingface dataset:
Command: evt.type=connect and (fd.typechar=4 or fd.typechar=6) and container and k8s_api_server and not k8s_containers and not user_known_contact_k8s_api_server_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Contact K8S API Server From Container
Notes: Detect attempts to communicate with the K8S API Server from a container by non-profiled users. Kubernetes APIs play a pivotal role in configuring the cluster management lifecycle. Detecting potential unauthorized access to the API server is of utmost importance. Audit your complete infrastructure and pinpoint any potential machines from which the API server might be accessible based on your network layout. If Falco can't operate on all these machines, consider analyzing the Kubernetes audit logs
Command: spawned_process and container and ((proc.name = "nc" and (proc.cmdline contains " -e" or proc.cmdline contains " -c")) or (proc.name = "ncat" and (proc.args contains "--sh-exec" or proc.args contains "--exec" or proc.args contains "-e " or proc.args contains "-c " or proc.args contains "--lua-exec")) )
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Netcat Remote Code Execution in Container
Notes: Netcat Program runs inside container that allows remote code execution and may be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/. These programs are of higher relevance as they are commonly installed on UNIX-like operating systems. Can fire in combination with the "Redirect STDOUT/STDIN to Network Connection in Container" rule as it utilizes a different evt.type.
Command: spawned_process and ((grep_commands and private_key_or_password) or (proc.name = "find" and (proc.args contains "id_rsa" or proc.args contains "id_dsa" or proc.args contains "id_ed25519" or proc.args contains "id_ecdsa" ) ))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Search Private Keys or Passwords
Notes: Detect attempts to search for private keys or passwords using the grep or find command. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level.
Command: open_write and access_log_files and evt.arg.flags contains "O_TRUNC" and not containerd_activities and not trusted_logging_images and not allowed_clear_log_files
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Clear Log Activities
Notes: Detect clearing of critical access log files, typically done to erase evidence that could be attributed to an adversary's actions. To effectively customize and operationalize this detection, check for potentially missing log file destinations relevant to your environment, and adjust the profiled containers you wish not to be alerted on.
Command: spawned_process and clear_data_procs and not user_known_remove_data_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Remove Bulk Data from Disk
Notes: Detect a process running to clear bulk data from disk with the intention to destroy data, possibly interrupting availability to systems. Profile your environment and use user_known_remove_data_activities to tune this rule.
Command: create_symlink and (evt.arg.target in (sensitive_file_names) or evt.arg.target in (sensitive_directory_names))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Create Symlink Over Sensitive Files
Notes: Detect symlinks created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted".
Command: create_hardlink and (evt.arg.oldpath in (sensitive_file_names))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Create Hardlink Over Sensitive Files
Notes: Detect hardlink created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted".
Command: evt.type=socket and container and evt.arg.domain contains AF_PACKET and not proc.name in (user_known_packet_socket_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Packet socket created in container
Notes: Detect new packet socket at the device driver (OSI Layer 2) level in a container. Packet socket could be used for ARP Spoofing and privilege escalation (CVE-2020-14386) by an attacker. Noise can be reduced by using the user_known_packet_socket_binaries template list.
Command: dup and container and evt.rawres in (0, 1, 2) and fd.type in ("ipv4", "ipv6") and not user_known_stand_streams_redirect_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Redirect STDOUT/STDIN to Network Connection in Container
Notes: Detect redirection of stdout/stdin to a network connection within a container, achieved by utilizing a variant of the dup syscall (potential reverse shell or remote code execution https://github.com/swisskyrepo/PayloadsAllTheThings/). This detection is behavior-based and may generate noise in the system, and can be adjusted using the user_known_stand_streams_redirect_activities template macro. Tuning can be performed similarly to existing detections based on process lineage or container images,
Command: kernel_module_load and container and thread.cap_effective icontains sys_module and not container.image.repository in (allowed_container_images_loading_kernel_module)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Linux Kernel Module Injection Detected
Notes: Inject Linux Kernel Modules from containers using insmod or modprobe with init_module and finit_module syscalls, given the precondition of sys_module effective capabilities. Profile the environment and consider allowed_container_images_loading_kernel_module to reduce noise and account for legitimate cases.
Command: spawned_process and container and container.privileged=true and proc.name=debugfs
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Debugfs Launched in Privileged Container
Notes: Detect file system debugger debugfs launched inside a privileged container which might lead to container escape. This rule has a more narrow scope.
Command: open_write and container and fd.name endswith release_agent and (user.uid=0 or thread.cap_effective contains CAP_DAC_OVERRIDE) and thread.cap_effective contains CAP_SYS_ADMIN
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Detect release_agent File Container Escapes
Notes: Detect an attempt to exploit a container escape using release_agent file. By running a container with certains capabilities, a privileged user can modify release_agent file and escape from the container.
Command: ptrace_attach_or_injection and proc_name_exists and not known_ptrace_procs
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: PTRACE attached to process
Notes: Detect an attempt to inject potentially malicious code into a process using PTRACE in order to evade process-based defenses or elevate privileges. Common anti-patterns are debuggers. Additionally, profiling your environment via the known_ptrace_procs template macro can reduce noise. A successful ptrace syscall generates multiple logs at once.
Command: evt.type=ptrace and evt.arg.request contains PTRACE_TRACEME and proc_name_exists
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: PTRACE anti-debug attempt
Notes: Detect usage of the PTRACE system call with the PTRACE_TRACEME argument, indicating a program actively attempting to avoid debuggers attaching to the process. This behavior is typically indicative of malware activity. Read more about PTRACE in the "PTRACE attached to process" rule.
Command: spawned_process and ((grep_commands and private_aws_credentials) or (proc.name = "find" and proc.args endswith ".aws/credentials"))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Find AWS Credentials
Notes: Detect attempts to search for private keys or passwords using the grep or find command, particularly targeting standard AWS credential locations. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level. This rule complements the rule "Search Private Keys or Passwords".
Command: spawned_process and (proc.exe startswith "/dev/shm/" or (proc.cwd startswith "/dev/shm/" and proc.exe startswith "./" ) or (shell_procs and proc.args startswith "-c /dev/shm") or (shell_procs and proc.args startswith "-i /dev/shm") or (shell_procs and proc.args startswith "/dev/shm") or (proc.cwd startswith "/dev/shm/" and proc.args startswith "./" )) and not container.image.repository in (falco_privileged_images, trusted_images)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Execution from /dev/shm
Notes: This rule detects file execution in the /dev/shm directory, a tactic often used by threat actors to store their readable, writable, and occasionally executable files. /dev/shm acts as a link to the host or other containers, creating vulnerabilities for their compromise as well. Notably, /dev/shm remains unchanged even after a container restart. Consider this rule alongside the newer "Drop and execute new binary in container" rule.
Command: spawned_process and container and proc.is_exe_upper_layer=true and not container.image.repository in (known_drop_and_execute_containers) and not known_drop_and_execute_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Drop and execute new binary in container
Notes: Detect if an executable not belonging to the base image of a container is being executed. The drop and execute pattern can be observed very often after an attacker gained an initial foothold. is_exe_upper_layer filter field only applies for container runtimes that use overlayfs as union mount filesystem. Adopters can utilize the provided template list known_drop_and_execute_containers containing allowed container images known to execute binaries not included in their base image. Alternatively, y
Command: outbound and proc.exe endswith ssh and fd.l4proto=tcp and ssh_non_standard_ports_network
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Disallowed SSH Connection Non Standard Port
Notes: Detect any new outbound SSH connection from the host or container using a non-standard port. This rule holds the potential to detect a family of reverse shells that cause the victim machine to connect back out over SSH, with STDIN piped from the SSH connection to a shell's STDIN, and STDOUT of the shell piped back over SSH. Such an attack can be launched against any app that is vulnerable to command injection. The upstream rule only covers a limited selection of non-standard ports. We suggest ad
Command: spawned_process and proc.is_exe_from_memfd=true and not known_memfd_execution_processes
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Fileless execution via memfd_create
Notes: Detect if a binary is executed from memory using the memfd_create technique. This is a well-known defense evasion technique for executing malware on a victim machine without storing the payload on disk and to avoid leaving traces about what has been executed. Adopters can whitelist processes that may use fileless execution for benign purposes by adding items to the list known_memfd_execution_processes.
Command: inbound_outbound and ssh_port and not allowed_ssh_hosts
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Disallowed SSH Connection
Notes: Detect any new SSH connection on port 22 to a host other than those in an allowed list of hosts. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.
Command: outbound and not ((fd.sip in (allowed_outbound_destination_ipaddrs)) or (fd.snet in (allowed_outbound_destination_networks)) or (fd.sip.name in (allowed_outbound_destination_domains)))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Unexpected outbound connection destination
Notes: Detect any outbound connection to a destination outside of an allowed set of ips, networks, or domain names. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.
Command: inbound_outbound and container and container.image.repository in (allowed_image) and not proc.name in (authorized_server_binary) and not fd.sport in (authorized_server_port)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Outbound or Inbound Traffic not to Authorized Server Process and Port
Notes: Detect traffic to an unauthorized server process and port within pre-defined containers. This rule absolutely requires profiling your environment beforehand and also necessitates adjusting the list of containers to which this rule will be applied. The current expression logic will never evaluate to true unless the list is populated. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them
Command: outbound and ((fd.sip in (c2_server_ip_list)) or (fd.sip.name in (c2_server_fqdn_list)))
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Outbound Connection to C2 Servers
Notes: Detect outbound connections to command and control servers using a list of IP addresses and fully qualified domain names (FQDNs). This rule absolutely requires profiling your environment beforehand and also necessitates adjusting the template lists. The current expression logic will never evaluate to true unless the lists are populated. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing
Command: write_etc_common
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: not a mitre rule
Notes: an attempt to write to any file below /etc
Command: container_started and container and not allowed_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: wrong mitre rule
Notes: Detect the initial process started by a container that is not in a list of allowed containers.
Command: (open_read or open_file_failed) and (etc_dir or user_ssh_directory or fd.name startswith /root/.ssh or fd.name contains "id_rsa") and directory_traversal and not proc.pname in (shell_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: correct mitre rule tactics tags with multiple techniques
Notes: Directory traversal monitored file read - Web applications can be vulnerable to directory traversal attacks that allow accessing files outside of the web app's root directory (e.g. Arbitrary File Read bugs). System directories like /etc are typically accessed via absolute paths. Access patterns outside of this (here path traversal) can be regarded as suspicious. This rule includes failed file open attempts.
Command: sensitive_files and open_read and proc_name_exists and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries, cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries, vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries, in.proftpd, mandb, salt-call, salt-minion, postgres_mgmt_binaries, google_oslogin_ ) and not cmp_cp_by_passwd and not ansible_running_python and not run_by_qualys and not run_by_chef and not run_by_google_accounts_daemon and not user_read_sensitive_file_conditions and not mandb_postinst and not perl_running_plesk and not perl_running_updmap and not veritas_driver_script and not perl_running_centrifydc and not runuser_reading_pam and not linux_bench_reading_etc_shadow and not user_known_read_sensitive_files_activities and not user_read_sensitive_file_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: wrong mitre rule multiple techniques and missing one tactic
Notes: Read sensitive file untrusted - an attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs.