43 lines
2.0 KiB
YAML
43 lines
2.0 KiB
YAML
# Custom runtime detections for the portfolio baseline.
|
|
# These rules supplement the default Falco rules and are intentionally scoped
|
|
# to container activity for a clear admission-to-runtime demonstration.
|
|
|
|
- list: sensitive_container_paths
|
|
items: [/etc/passwd, /etc/shadow, /etc/sudoers, /etc/ssh/sshd_config]
|
|
|
|
- macro: container_activity
|
|
condition: container.id != host
|
|
|
|
- rule: Shell spawned in container
|
|
desc: A shell process was started inside a running container.
|
|
condition: evt.type in (execve, execveat) and container_activity and proc.name in (bash, sh, ash, zsh, ksh, fish)
|
|
output: >-
|
|
Shell spawned in container
|
|
(user=%user.name user_uid=%user.uid shell=%proc.name command=%proc.cmdline
|
|
container_id=%container.id container_image=%container.image.repository
|
|
container_name=%container.name k8s_ns=%k8s.ns.name k8s_pod=%k8s.pod.name)
|
|
priority: WARNING
|
|
tags: [container, process, baseline]
|
|
|
|
- rule: Sensitive file modified in container
|
|
desc: A process attempted to write a sensitive host-like file from a container.
|
|
condition: evt.type in (open, openat, openat2) and evt.is_open_write=true and container_activity and fd.name in (sensitive_container_paths)
|
|
output: >-
|
|
Sensitive file modified in container
|
|
(user=%user.name command=%proc.cmdline file=%fd.name
|
|
container_id=%container.id container_image=%container.image.repository
|
|
k8s_ns=%k8s.ns.name k8s_pod=%k8s.pod.name)
|
|
priority: ERROR
|
|
tags: [container, filesystem, persistence, baseline]
|
|
|
|
- rule: Unexpected outbound connection from container
|
|
desc: A container opened a connection to a non-loopback address.
|
|
condition: evt.type=connect and container_activity and not fd.sip in (127.0.0.1, 0.0.0.0)
|
|
output: >-
|
|
Outbound connection from container
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name
|
|
container_id=%container.id container_image=%container.image.repository
|
|
k8s_ns=%k8s.ns.name k8s_pod=%k8s.pod.name)
|
|
priority: NOTICE
|
|
tags: [container, network, baseline]
|