f31cfb2ef9
Based on spec in openstack-helm repo, support-OCI-image-registry-with-authentication-turned-on.rst Each Helm chart can configure an OCI image registry and credentials to use. A Kubernetes secret is then created with these info. Service Accounts then specify an imagePullSecret specifying the Secret with creds for the registry. Then any pod using one of these ServiceAccounts may pull images from an authenticated container registry. Change-Id: Iebda4c7a861aa13db921328776b20c14ba346269
1387 lines
68 KiB
YAML
1387 lines
68 KiB
YAML
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
---
|
|
images:
|
|
pull_policy: IfNotPresent
|
|
tags:
|
|
dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
|
|
falco: docker.io/sysdig/falco:0.12.1
|
|
image_repo_sync: docker.io/library/docker:17.07.0
|
|
local_registry:
|
|
active: false
|
|
exclude:
|
|
- dep_check
|
|
- image_repo_sync
|
|
|
|
secrets:
|
|
oci_image_registry:
|
|
falco: falco-oci-image-registry-key
|
|
|
|
endpoints:
|
|
cluster_domain_suffix: cluster.local
|
|
oci_image_registry:
|
|
name: oci-image-registry
|
|
namespace: oci-image-registry
|
|
auth:
|
|
enabled: false
|
|
falco:
|
|
username: falco
|
|
password: password
|
|
hosts:
|
|
default: localhost
|
|
host_fqdn_override:
|
|
default: null
|
|
port:
|
|
registry:
|
|
default: null
|
|
|
|
pod:
|
|
resources:
|
|
enabled: false
|
|
falco:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "20m"
|
|
limits:
|
|
memory: "128Mi"
|
|
cpu: "30m"
|
|
jobs:
|
|
image_repo_sync:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "20m"
|
|
limits:
|
|
memory: "128Mi"
|
|
cpu: "30m"
|
|
lifecycle:
|
|
upgrades:
|
|
daemonsets:
|
|
pod_replacement_strategy: RollingUpdate
|
|
falco:
|
|
enabled: true
|
|
min_ready_seconds: 0
|
|
max_unavailable: 1
|
|
tolerations:
|
|
falco:
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/master
|
|
|
|
|
|
conf:
|
|
config:
|
|
# The location of the rules file(s). This can contain one or more paths to
|
|
# separate rules files.
|
|
rules_file:
|
|
- /etc/falco/falco_rules.yaml
|
|
- /etc/falco/falco_rules.local.yaml
|
|
- /etc/falco/rules.d
|
|
|
|
# Whether to output events in json or text
|
|
json_output: false
|
|
|
|
# When using json output, whether or not to include the "output" property
|
|
# itself (e.g. "File below a known binary directory opened for writing
|
|
# (user=root ....") in the json output.
|
|
json_include_output_property: true
|
|
|
|
# Send information logs to stderr and/or syslog Note these are *not* security
|
|
# notification logs! These are just Falco lifecycle (and possibly error) logs.
|
|
log_stderr: true
|
|
log_syslog: true
|
|
|
|
# Minimum log level to include in logs. Note: these levels are
|
|
# separate from the priority field of rules. This refers only to the
|
|
# log level of falco's internal logging. Can be one of "emergency",
|
|
# "alert", "critical", "error", "warning", "notice", "info", "debug".
|
|
log_level: info
|
|
|
|
# Minimum rule priority level to load and run. All rules having a
|
|
# priority more severe than this level will be loaded/run. Can be one
|
|
# of "emergency", "alert", "critical", "error", "warning", "notice",
|
|
# "info", "debug".
|
|
priority: debug
|
|
|
|
# Whether or not output to any of the output channels below is
|
|
# buffered.
|
|
buffered_outputs: false
|
|
|
|
# A throttling mechanism implemented as a token bucket limits the
|
|
# rate of falco notifications. This throttling is controlled by the following configuration
|
|
# options:
|
|
# - rate: the number of tokens (i.e. right to send a notification)
|
|
# gained per second. Defaults to 1.
|
|
# - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
|
|
#
|
|
# With these defaults, falco could send up to 1000 notifications after
|
|
# an initial quiet period, and then up to 1 notification per second
|
|
# afterward. It would gain the full burst back after 1000 seconds of
|
|
# no activity.
|
|
outputs:
|
|
rate: 1
|
|
max_burst: 1000
|
|
|
|
# Where security notifications should go.
|
|
# Multiple outputs can be enabled.
|
|
syslog_output:
|
|
enabled: true
|
|
|
|
# If keep_alive is set to true, the file will be opened once and
|
|
# continuously written to, with each output message on its own
|
|
# line. If keep_alive is set to false, the file will be re-opened
|
|
# for each output message.
|
|
#
|
|
# Also, the file will be closed and reopened if falco is signaled with
|
|
# SIGUSR1.
|
|
file_output:
|
|
enabled: false
|
|
keep_alive: false
|
|
filename: ./events.txt
|
|
|
|
stdout_output:
|
|
enabled: true
|
|
|
|
# Possible additional things you might want to do with program output:
|
|
# - send to a slack webhook:
|
|
# program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
|
|
# - logging (alternate method than syslog):
|
|
# program: logger -t falco-test
|
|
# - send over a network connection:
|
|
# program: nc host.example.com 80
|
|
|
|
# If keep_alive is set to true, the program will be started once and
|
|
# continuously written to, with each output message on its own
|
|
# line. If keep_alive is set to false, the program will be re-spawned
|
|
# for each output message.
|
|
#
|
|
# Also, the program will be closed and reopened if falco is signaled with
|
|
# SIGUSR1.
|
|
program_output:
|
|
enabled: false
|
|
keep_alive: false
|
|
program: mail -s "Falco Notification" someone@example.com
|
|
rules:
|
|
falco_rules: |
|
|
- macro: open_write
|
|
condition: (evt.type=open or evt.type=openat) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0
|
|
- macro: open_read
|
|
condition: (evt.type=open or evt.type=openat) and evt.is_open_read=true and fd.typechar='f' and fd.num>=0
|
|
- macro: never_true
|
|
condition: (evt.num=0)
|
|
- macro: always_true
|
|
condition: (evt.num=>0)
|
|
- macro: proc_name_exists
|
|
condition: (proc.name!="<NA>")
|
|
- macro: rename
|
|
condition: evt.type in (rename, renameat)
|
|
- macro: mkdir
|
|
condition: evt.type = mkdir
|
|
- macro: remove
|
|
condition: evt.type in (rmdir, unlink, unlinkat)
|
|
- macro: modify
|
|
condition: rename or remove
|
|
- macro: spawned_process
|
|
condition: evt.type = execve and evt.dir=<
|
|
- macro: bin_dir
|
|
condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)
|
|
- macro: bin_dir_mkdir
|
|
condition: >
|
|
(evt.arg[1] startswith /bin/ or
|
|
evt.arg[1] startswith /sbin/ or
|
|
evt.arg[1] startswith /usr/bin/ or
|
|
evt.arg[1] startswith /usr/sbin/)
|
|
- macro: bin_dir_rename
|
|
condition: >
|
|
evt.arg[1] startswith /bin/ or
|
|
evt.arg[1] startswith /sbin/ or
|
|
evt.arg[1] startswith /usr/bin/ or
|
|
evt.arg[1] startswith /usr/sbin/
|
|
- macro: etc_dir
|
|
condition: fd.name startswith /etc/
|
|
- macro: root_dir
|
|
condition: ((fd.directory=/ or fd.name startswith /root) and fd.name contains "/")
|
|
- list: shell_binaries
|
|
items: [bash, csh, ksh, sh, tcsh, zsh, dash]
|
|
- list: shell_mgmt_binaries
|
|
items: [add-shell, remove-shell]
|
|
- macro: shell_procs
|
|
condition: (proc.name in (shell_binaries))
|
|
- list: coreutils_binaries
|
|
items: [
|
|
truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,
|
|
groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,
|
|
basename, split, nice, "yes", whoami, sha224sum, hostid, users, stdbuf,
|
|
base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,
|
|
comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,
|
|
tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,
|
|
tail, "[", seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,
|
|
tac, link, chroot, vdir, chown, touch, ls, dd, uname, "true", pwd, date,
|
|
chgrp, chmod, mktemp, cat, mknod, sync, ln, "false", rm, mv, cp, echo,
|
|
readlink, sleep, stty, mkdir, df, dir, rmdir, touch
|
|
]
|
|
- list: login_binaries
|
|
items: [
|
|
login, systemd, '"(systemd)"', systemd-logind, su,
|
|
nologin, faillog, lastlog, newgrp, sg
|
|
]
|
|
- list: passwd_binaries
|
|
items: [
|
|
shadowconfig, grpck, pwunconv, grpconv, pwck,
|
|
groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,
|
|
groupadd, groupdel, grpunconv, chgpasswd, userdel, chage, chsh,
|
|
gpasswd, chfn, expiry, passwd, vigr, cpgr
|
|
]
|
|
- list: shadowutils_binaries
|
|
items: [
|
|
chage, gpasswd, lastlog, newgrp, sg, adduser, deluser, chpasswd,
|
|
groupadd, groupdel, addgroup, delgroup, groupmems, groupmod, grpck, grpconv, grpunconv,
|
|
newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw, unix_chkpwd
|
|
]
|
|
- list: sysdigcloud_binaries
|
|
items: [setup-backend, dragent, sdchecks]
|
|
- list: docker_binaries
|
|
items: [docker, dockerd, exe, docker-compose, docker-entrypoi, docker-runc-cur, docker-current]
|
|
- list: k8s_binaries
|
|
items: [hyperkube, skydns, kube2sky, exechealthz]
|
|
- list: lxd_binaries
|
|
items: [lxd, lxcfs]
|
|
- list: http_server_binaries
|
|
items: [nginx, httpd, httpd-foregroun, lighttpd, apache, apache2]
|
|
- list: db_server_binaries
|
|
items: [mysqld, postgres, sqlplus]
|
|
- list: mysql_mgmt_binaries
|
|
items: [mysql_install_d, mysql_ssl_rsa_s]
|
|
- list: postgres_mgmt_binaries
|
|
items: [pg_dumpall, pg_ctl, pg_lsclusters, pg_ctlcluster]
|
|
- list: db_mgmt_binaries
|
|
items: [mysql_mgmt_binaries, postgres_mgmt_binaries]
|
|
- list: nosql_server_binaries
|
|
items: [couchdb, memcached, redis-server, rabbitmq-server, mongod]
|
|
- list: gitlab_binaries
|
|
items: [gitlab-shell, gitlab-mon, gitlab-runner-b, git]
|
|
- macro: server_procs
|
|
condition: proc.name in (http_server_binaries, db_server_binaries, docker_binaries, sshd)
|
|
- list: rpm_binaries
|
|
items: [dnf, rpm, rpmkey, yum, '"75-system-updat"', rhsmcertd-worke, subscription-ma,
|
|
repoquery, rpmkeys, rpmq, yum-cron, yum-config-mana, yum-debug-dump,
|
|
abrt-action-sav, rpmdb_stat, microdnf]
|
|
- macro: rpm_procs
|
|
condition: proc.name in (rpm_binaries) or proc.name in (salt-minion)
|
|
- list: deb_binaries
|
|
items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,
|
|
frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key,
|
|
apt-listchanges, unattended-upgr, apt-add-reposit
|
|
]
|
|
- list: package_mgmt_binaries
|
|
items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client]
|
|
- macro: package_mgmt_procs
|
|
condition: proc.name in (package_mgmt_binaries)
|
|
- macro: coreos_write_ssh_dir
|
|
condition: (proc.name=update-ssh-keys and fd.name startswith /home/core/.ssh)
|
|
- macro: run_by_package_mgmt_binaries
|
|
condition: proc.aname in (package_mgmt_binaries, needrestart)
|
|
- list: ssl_mgmt_binaries
|
|
items: [ca-certificates]
|
|
- list: dhcp_binaries
|
|
items: [dhclient, dhclient-script]
|
|
- list: userexec_binaries
|
|
items: [sudo, su, suexec]
|
|
- list: known_setuid_binaries
|
|
items: [
|
|
sshd, dbus-daemon-lau, ping, ping6, critical-stack-, pmmcli,
|
|
filemng, PassengerAgent, bwrap, osdetect, nginxmng, sw-engine-fpm,
|
|
start-stop-daem
|
|
]
|
|
- list: user_mgmt_binaries
|
|
items: [login_binaries, passwd_binaries, shadowutils_binaries]
|
|
- list: dev_creation_binaries
|
|
items: [blkid, rename_device, update_engine, sgdisk]
|
|
- list: hids_binaries
|
|
items: [aide]
|
|
- list: vpn_binaries
|
|
items: [openvpn]
|
|
- list: nomachine_binaries
|
|
items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin]
|
|
- macro: system_procs
|
|
condition: proc.name in (coreutils_binaries, user_mgmt_binaries)
|
|
- list: mail_binaries
|
|
items: [
|
|
sendmail, sendmail-msp, postfix, procmail, exim4,
|
|
pickup, showq, mailq, dovecot, imap-login, imap,
|
|
mailmng-core, pop3-login, dovecot-lda, pop3
|
|
]
|
|
- list: mail_config_binaries
|
|
items: [
|
|
update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4,
|
|
update_db, update_mc, ssmtp.postinst, mailq, postalias, postfix.config.,
|
|
postfix.config, postfix-script
|
|
]
|
|
- list: sensitive_file_names
|
|
items: [/etc/shadow, /etc/sudoers, /etc/pam.conf]
|
|
- macro: sensitive_files
|
|
condition: >
|
|
fd.name startswith /etc and
|
|
(fd.name in (sensitive_file_names)
|
|
or fd.directory in (/etc/sudoers.d, /etc/pam.d))
|
|
- macro: proc_is_new
|
|
condition: proc.duration <= 5000000000
|
|
- macro: inbound
|
|
condition: >
|
|
(((evt.type in (accept,listen) and evt.dir=<)) or
|
|
(fd.typechar = 4 or fd.typechar = 6) and
|
|
(fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
|
|
(evt.rawres >= 0 or evt.res = EINPROGRESS))
|
|
- macro: outbound
|
|
condition: >
|
|
(((evt.type = connect and evt.dir=<)) or
|
|
(fd.typechar = 4 or fd.typechar = 6) and
|
|
(fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
|
|
(evt.rawres >= 0 or evt.res = EINPROGRESS))
|
|
- macro: inbound_outbound
|
|
condition: >
|
|
(((evt.type in (accept,listen,connect) and evt.dir=<)) or
|
|
(fd.typechar = 4 or fd.typechar = 6) and
|
|
(fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
|
|
(evt.rawres >= 0 or evt.res = EINPROGRESS))
|
|
- macro: ssh_port
|
|
condition: fd.sport=22
|
|
- macro: allowed_ssh_hosts
|
|
condition: ssh_port
|
|
- rule: Disallowed SSH Connection
|
|
desc: Detect any new ssh connection to a host other than those in an allowed group of hosts
|
|
condition: (inbound_outbound) and ssh_port and not allowed_ssh_hosts
|
|
output: Disallowed SSH Connection (command=%proc.cmdline connection=%fd.name user=%user.name)
|
|
priority: NOTICE
|
|
tags: [network]
|
|
- macro: container
|
|
condition: container.id != host
|
|
- macro: interactive
|
|
condition: >
|
|
((proc.aname=sshd and proc.name != sshd) or
|
|
proc.name=systemd-logind or proc.name=login)
|
|
- list: cron_binaries
|
|
items: [anacron, cron, crond, crontab]
|
|
- list: needrestart_binaries
|
|
items: [needrestart, 10-dpkg, 20-rpm, 30-pacman]
|
|
- list: sshkit_script_binaries
|
|
items: [10_etc_sudoers., 10_passwd_group]
|
|
- list: plesk_binaries
|
|
items: [sw-engine, sw-engine-fpm, sw-engine-kv, filemng, f2bmng]
|
|
- macro: system_users
|
|
condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data)
|
|
- macro: parent_ansible_running_python
|
|
condition: (proc.pname in (python, pypy) and proc.pcmdline contains ansible)
|
|
- macro: parent_bro_running_python
|
|
condition: (proc.pname=python and proc.cmdline contains /usr/share/broctl)
|
|
- macro: parent_python_running_denyhosts
|
|
condition: >
|
|
(proc.cmdline startswith "denyhosts.py /usr/bin/denyhosts.py" or
|
|
(proc.pname=python and
|
|
(proc.pcmdline contains /usr/sbin/denyhosts or
|
|
proc.pcmdline contains /usr/local/bin/denyhosts.py)))
|
|
- macro: parent_python_running_sdchecks
|
|
condition: >
|
|
(proc.pname in (python, python2.7) and
|
|
(proc.pcmdline contains /opt/draios/bin/sdchecks))
|
|
- macro: parent_linux_image_upgrade_script
|
|
condition: proc.pname startswith linux-image-
|
|
- macro: parent_java_running_echo
|
|
condition: (proc.pname=java and proc.cmdline startswith "sh -c echo")
|
|
- macro: parent_scripting_running_builds
|
|
condition: >
|
|
(proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,ruby2.1,node,conda) and (
|
|
proc.cmdline startswith "sh -c git" or
|
|
proc.cmdline startswith "sh -c date" or
|
|
proc.cmdline startswith "sh -c /usr/bin/g++" or
|
|
proc.cmdline startswith "sh -c /usr/bin/gcc" or
|
|
proc.cmdline startswith "sh -c gcc" or
|
|
proc.cmdline startswith "sh -c if type gcc" or
|
|
proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git" or
|
|
proc.cmdline startswith "sh -c /var/www/edi/bin/sftp.sh" or
|
|
proc.cmdline startswith "sh -c /usr/src/app/crxlsx/bin/linux/crxlsx" or
|
|
proc.cmdline startswith "sh -c make parent" or
|
|
proc.cmdline startswith "node /jenkins/tools" or
|
|
proc.cmdline startswith "sh -c '/usr/bin/node'" or
|
|
proc.cmdline startswith "sh -c stty -a |" or
|
|
proc.pcmdline startswith "node /opt/nodejs/bin/yarn" or
|
|
proc.pcmdline startswith "node /usr/local/bin/yarn" or
|
|
proc.pcmdline startswith "node /root/.config/yarn" or
|
|
proc.pcmdline startswith "node /opt/yarn/bin/yarn.js"))
|
|
- macro: httpd_writing_ssl_conf
|
|
condition: >
|
|
(proc.pname=run-httpd and
|
|
(proc.cmdline startswith "sed -ri" or proc.cmdline startswith "sed -i") and
|
|
(fd.name startswith /etc/httpd/conf.d/ or fd.name startswith /etc/httpd/conf))
|
|
- macro: userhelper_writing_etc_security
|
|
condition: (proc.name=userhelper and fd.name startswith /etc/security)
|
|
- macro: parent_Xvfb_running_xkbcomp
|
|
condition: (proc.pname=Xvfb and proc.cmdline startswith 'sh -c "/usr/bin/xkbcomp"')
|
|
- macro: parent_nginx_running_serf
|
|
condition: (proc.pname=nginx and proc.cmdline startswith "sh -c serf")
|
|
- macro: parent_node_running_npm
|
|
condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or
|
|
proc.pcmdline startswith "node /usr/local/nodejs/bin/npm" or
|
|
proc.pcmdline startswith "node /opt/rh/rh-nodejs6/root/usr/bin/npm")
|
|
- macro: parent_java_running_sbt
|
|
condition: (proc.pname=java and proc.pcmdline contains sbt-launch.jar)
|
|
- list: known_container_shell_spawn_cmdlines
|
|
items: []
|
|
- list: known_shell_spawn_binaries
|
|
items: []
|
|
- macro: ansible_running_python
|
|
condition: (proc.name in (python, pypy) and proc.cmdline contains ansible)
|
|
- macro: python_running_chef
|
|
condition: (proc.name=python and (proc.cmdline contains yum-dump.py or proc.cmdline="python /usr/bin/chef-monitor.py"))
|
|
- macro: python_running_denyhosts
|
|
condition: >
|
|
(proc.name=python and
|
|
(proc.cmdline contains /usr/sbin/denyhosts or
|
|
proc.cmdline contains /usr/local/bin/denyhosts.py))
|
|
- macro: run_by_qualys
|
|
condition: >
|
|
(proc.pname=qualys-cloud-ag or
|
|
proc.aname[2]=qualys-cloud-ag or
|
|
proc.aname[3]=qualys-cloud-ag or
|
|
proc.aname[4]=qualys-cloud-ag)
|
|
- macro: run_by_sumologic_securefiles
|
|
condition: >
|
|
((proc.cmdline="usermod -a -G sumologic_collector" or
|
|
proc.cmdline="groupadd sumologic_collector") and
|
|
(proc.pname=secureFiles.sh and proc.aname[2]=java))
|
|
- macro: run_by_yum
|
|
condition: ((proc.pname=sh and proc.aname[2]=yum) or
|
|
(proc.aname[2]=sh and proc.aname[3]=yum))
|
|
- macro: run_by_ms_oms
|
|
condition: >
|
|
(proc.aname[3] startswith omsagent- or
|
|
proc.aname[3] startswith scx-)
|
|
- macro: run_by_google_accounts_daemon
|
|
condition: >
|
|
(proc.aname[1] startswith google_accounts or
|
|
proc.aname[2] startswith google_accounts)
|
|
- macro: run_by_chef
|
|
condition: (proc.aname[2]=chef_command_wr or proc.aname[3]=chef_command_wr or
|
|
proc.aname[2]=chef-client or proc.aname[3]=chef-client or
|
|
proc.name=chef-client)
|
|
- macro: run_by_adclient
|
|
condition: (proc.aname[2]=adclient or proc.aname[3]=adclient or proc.aname[4]=adclient)
|
|
- macro: run_by_centrify
|
|
condition: (proc.aname[2]=centrify or proc.aname[3]=centrify or proc.aname[4]=centrify)
|
|
- macro: run_by_puppet
|
|
condition: (proc.aname[2]=puppet or proc.aname[3]=puppet)
|
|
- macro: run_by_foreman
|
|
condition: >
|
|
(user.name=foreman and
|
|
(proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or
|
|
(proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby)))
|
|
- macro: java_running_sdjagent
|
|
condition: proc.name=java and proc.cmdline contains sdjagent.jar
|
|
- macro: kubelet_running_loopback
|
|
condition: (proc.pname=kubelet and proc.name=loopback)
|
|
- macro: python_mesos_marathon_scripting
|
|
condition: (proc.pcmdline startswith "python3 /marathon-lb/marathon_lb.py")
|
|
- macro: splunk_running_forwarder
|
|
condition: (proc.pname=splunkd and proc.cmdline startswith "sh -c /opt/splunkforwarder")
|
|
- macro: parent_supervise_running_multilog
|
|
condition: (proc.name=multilog and proc.pname=supervise)
|
|
- macro: supervise_writing_status
|
|
condition: (proc.name in (supervise,svc) and fd.name startswith "/etc/sb/")
|
|
- macro: pki_realm_writing_realms
|
|
condition: (proc.cmdline startswith "bash /usr/local/lib/pki/pki-realm" and fd.name startswith /etc/pki/realms)
|
|
- macro: htpasswd_writing_passwd
|
|
condition: (proc.name=htpasswd and fd.name=/etc/nginx/.htpasswd)
|
|
- macro: lvprogs_writing_conf
|
|
condition: >
|
|
(proc.name in (dmeventd,lvcreate,pvscan) and
|
|
(fd.name startswith /etc/lvm/archive or
|
|
fd.name startswith /etc/lvm/backup or
|
|
fd.name startswith /etc/lvm/cache))
|
|
- macro: ovsdb_writing_openvswitch
|
|
condition: (proc.name=ovsdb-server and fd.directory=/etc/openvswitch)
|
|
- macro: perl_running_plesk
|
|
condition: (proc.cmdline startswith "perl /opt/psa/admin/bin/plesk_agent_manager" or
|
|
proc.pcmdline startswith "perl /opt/psa/admin/bin/plesk_agent_manager")
|
|
- macro: perl_running_updmap
|
|
condition: (proc.cmdline startswith "perl /usr/bin/updmap")
|
|
- macro: perl_running_centrifydc
|
|
condition: (proc.cmdline startswith "perl /usr/share/centrifydc")
|
|
- macro: parent_ucf_writing_conf
|
|
condition: (proc.pname=ucf and proc.aname[2]=frontend)
|
|
- macro: consul_template_writing_conf
|
|
condition: >
|
|
((proc.name=consul-template and fd.name startswith /etc/haproxy) or
|
|
(proc.name=reload.sh and proc.aname[2]=consul-template and fd.name startswith /etc/ssl))
|
|
- macro: countly_writing_nginx_conf
|
|
condition: (proc.cmdline startswith "nodejs /opt/countly/bin" and fd.name startswith /etc/nginx)
|
|
- list: ms_oms_binaries
|
|
items: [omi.postinst, omsconfig.posti, scx.postinst, omsadmin.sh, omiagent]
|
|
- macro: ms_oms_writing_conf
|
|
condition: >
|
|
((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor)
|
|
or proc.pname in (ms_oms_binaries)
|
|
or proc.aname[2] in (ms_oms_binaries))
|
|
and (fd.name startswith /etc/opt/omi or fd.name startswith /etc/opt/microsoft/omsagent))
|
|
- macro: ms_scx_writing_conf
|
|
condition: (proc.name in (GetLinuxOS.sh) and fd.name startswith /etc/opt/microsoft/scx)
|
|
- macro: azure_scripts_writing_conf
|
|
condition: (proc.pname startswith "bash /var/lib/waagent/" and fd.name startswith /etc/azure)
|
|
- macro: azure_networkwatcher_writing_conf
|
|
condition: (proc.name in (NetworkWatcherA) and fd.name=/etc/init.d/AzureNetworkWatcherAgent)
|
|
- macro: couchdb_writing_conf
|
|
condition: (proc.name=beam.smp and proc.cmdline contains couchdb and fd.name startswith /etc/couchdb)
|
|
- macro: update_texmf_writing_conf
|
|
condition: (proc.name=update-texmf and fd.name startswith /etc/texmf)
|
|
- macro: slapadd_writing_conf
|
|
condition: (proc.name=slapadd and fd.name startswith /etc/ldap)
|
|
- macro: openldap_writing_conf
|
|
condition: (proc.pname=run-openldap.sh and fd.name startswith /etc/openldap)
|
|
- macro: ucpagent_writing_conf
|
|
condition: (proc.name=apiserver and container.image startswith docker/ucp-agent and fd.name=/etc/authorization_config.cfg)
|
|
- macro: iscsi_writing_conf
|
|
condition: (proc.name=iscsiadm and fd.name startswith /etc/iscsi)
|
|
- macro: symantec_writing_conf
|
|
condition: >
|
|
((proc.name=symcfgd and fd.name startswith /etc/symantec) or
|
|
(proc.name=navdefutil and fd.name=/etc/symc-defutils.conf))
|
|
- macro: liveupdate_writing_conf
|
|
condition: (proc.cmdline startswith "java LiveUpdate" and fd.name in (/etc/liveupdate.conf, /etc/Product.Catalog.JavaLiveUpdate))
|
|
- macro: sosreport_writing_files
|
|
condition: >
|
|
(proc.name=urlgrabber-ext- and proc.aname[3]=sosreport and
|
|
(fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))
|
|
- macro: pkgmgmt_progs_writing_pki
|
|
condition: >
|
|
(proc.name=urlgrabber-ext- and proc.pname in (yum, yum-cron, repoquery) and
|
|
(fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))
|
|
- macro: update_ca_trust_writing_pki
|
|
condition: (proc.pname=update-ca-trust and proc.name=trust and fd.name startswith /etc/pki)
|
|
- macro: brandbot_writing_os_release
|
|
condition: proc.name=brandbot and fd.name=/etc/os-release
|
|
- macro: selinux_writing_conf
|
|
condition: (proc.name in (semodule,genhomedircon,sefcontext_comp) and fd.name startswith /etc/selinux)
|
|
- list: veritas_binaries
|
|
items: [vxconfigd, sfcache, vxclustadm, vxdctl, vxprint, vxdmpadm, vxdisk, vxdg, vxassist, vxtune]
|
|
- macro: veritas_driver_script
|
|
condition: (proc.cmdline startswith "perl /opt/VRTSsfmh/bin/mh_driver.pl")
|
|
- macro: veritas_progs
|
|
condition: (proc.name in (veritas_binaries) or veritas_driver_script)
|
|
- macro: veritas_writing_config
|
|
condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom))
|
|
- macro: nginx_writing_conf
|
|
condition: (proc.name=nginx and fd.name startswith /etc/nginx)
|
|
- macro: nginx_writing_certs
|
|
condition: >
|
|
(((proc.name=openssl and proc.pname=nginx-launch.sh) or proc.name=nginx-launch.sh) and fd.name startswith /etc/nginx/certs)
|
|
- macro: chef_client_writing_conf
|
|
condition: (proc.pcmdline startswith "chef-client /opt/gitlab" and fd.name startswith /etc/gitlab)
|
|
- macro: centrify_writing_krb
|
|
condition: (proc.name in (adjoin,addns) and fd.name startswith /etc/krb5)
|
|
- macro: cockpit_writing_conf
|
|
condition: >
|
|
((proc.pname=cockpit-kube-la or proc.aname[2]=cockpit-kube-la)
|
|
and fd.name startswith /etc/cockpit)
|
|
- macro: ipsec_writing_conf
|
|
condition: (proc.name=start-ipsec.sh and fd.directory=/etc/ipsec)
|
|
- macro: exe_running_docker_save
|
|
condition: (proc.cmdline startswith "exe /var/lib/docker" and proc.pname in (dockerd, docker))
|
|
- macro: sed_temporary_file
|
|
condition: (proc.name=sed and fd.name startswith "/etc/sed")
|
|
- macro: python_running_get_pip
|
|
condition: (proc.cmdline startswith "python get-pip.py")
|
|
- macro: python_running_ms_oms
|
|
condition: (proc.cmdline startswith "python /var/lib/waagent/")
|
|
- macro: gugent_writing_guestagent_log
|
|
condition: (proc.name=gugent and fd.name=GuestAgent.log)
|
|
- macro: dse_writing_tmp
|
|
condition: (proc.name=dse-entrypoint and fd.name=/root/tmp__)
|
|
- macro: zap_writing_state
|
|
condition: (proc.name=java and proc.cmdline contains "jar /zap" and fd.name startswith /root/.ZAP)
|
|
- macro: airflow_writing_state
|
|
condition: (proc.name=airflow and fd.name startswith /root/airflow)
|
|
- macro: rpm_writing_root_rpmdb
|
|
condition: (proc.name=rpm and fd.directory=/root/.rpmdb)
|
|
- macro: maven_writing_groovy
|
|
condition: (proc.name=java and proc.cmdline contains "classpath /usr/local/apache-maven" and fd.name startswith /root/.groovy)
|
|
- rule: Write below binary dir
|
|
desc: an attempt to write to any file below a set of binary directories
|
|
condition: >
|
|
bin_dir and evt.dir = < and open_write
|
|
and not package_mgmt_procs
|
|
and not exe_running_docker_save
|
|
and not python_running_get_pip
|
|
and not python_running_ms_oms
|
|
output: >
|
|
File below a known binary directory opened for writing (user=%user.name
|
|
command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2])
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- list: monitored_directories
|
|
items: [/boot, /lib, /lib64, /usr/lib, /usr/local/lib, /usr/local/sbin, /usr/local/bin, /root/.ssh, /etc/cardserver]
|
|
- macro: user_ssh_directory
|
|
condition: (fd.name startswith '/home' and fd.name contains '.ssh')
|
|
- macro: mkinitramfs_writing_boot
|
|
condition: (proc.pname in (mkinitramfs, update-initramf) and fd.directory=/boot)
|
|
- macro: monitored_dir
|
|
condition: >
|
|
(fd.directory in (monitored_directories)
|
|
or user_ssh_directory)
|
|
and not mkinitramfs_writing_boot
|
|
- rule: Write below monitored dir
|
|
desc: an attempt to write to any file below a set of binary directories
|
|
condition: >
|
|
evt.dir = < and open_write and monitored_dir
|
|
and not package_mgmt_procs
|
|
and not coreos_write_ssh_dir
|
|
and not exe_running_docker_save
|
|
and not python_running_get_pip
|
|
and not python_running_ms_oms
|
|
output: >
|
|
File below a monitored directory opened for writing (user=%user.name
|
|
command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2])
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- list: safe_etc_dirs
|
|
items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig]
|
|
- macro: fluentd_writing_conf_files
|
|
condition: (proc.name=start-fluentd and fd.name in (/etc/fluent/fluent.conf, /etc/td-agent/td-agent.conf))
|
|
- macro: qualys_writing_conf_files
|
|
condition: (proc.name=qualys-cloud-ag and fd.name=/etc/qualys/cloud-agent/qagent-log.conf)
|
|
- macro: git_writing_nssdb
|
|
condition: (proc.name=git-remote-http and fd.directory=/etc/pki/nssdb)
|
|
- macro: plesk_writing_keys
|
|
condition: (proc.name in (plesk_binaries) and fd.name startswith /etc/sw/keys)
|
|
- macro: plesk_install_writing_apache_conf
|
|
condition: (proc.cmdline startswith "bash -hB /usr/lib/plesk-9.0/services/webserver.apache configure"
|
|
and fd.name="/etc/apache2/apache2.conf.tmp")
|
|
- macro: plesk_running_mktemp
|
|
condition: (proc.name=mktemp and proc.aname[3] in (plesk_binaries))
|
|
- macro: networkmanager_writing_resolv_conf
|
|
condition: proc.aname[2]=nm-dispatcher and fd.name=/etc/resolv.conf
|
|
- macro: add_shell_writing_shells_tmp
|
|
condition: (proc.name=add-shell and fd.name=/etc/shells.tmp)
|
|
- macro: duply_writing_exclude_files
|
|
condition: (proc.name=touch and proc.pcmdline startswith "bash /usr/bin/duply" and fd.name startswith "/etc/duply")
|
|
- macro: xmlcatalog_writing_files
|
|
condition: (proc.name=update-xmlcatal and fd.directory=/etc/xml)
|
|
- macro: datadog_writing_conf
|
|
condition: ((proc.cmdline startswith "python /opt/datadog-agent" or
|
|
proc.cmdline startswith "entrypoint.sh /entrypoint.sh datadog start" or
|
|
proc.cmdline startswith "agent.py /opt/datadog-agent")
|
|
and fd.name startswith "/etc/dd-agent")
|
|
- macro: curl_writing_pki_db
|
|
condition: (proc.name=curl and fd.directory=/etc/pki/nssdb)
|
|
- macro: haproxy_writing_conf
|
|
condition: ((proc.name in (update-haproxy-,haproxy_reload.) or proc.pname in (update-haproxy-,haproxy_reload,haproxy_reload.))
|
|
and (fd.name=/etc/openvpn/client.map or fd.name startswith /etc/haproxy))
|
|
- macro: java_writing_conf
|
|
condition: (proc.name=java and fd.name=/etc/.java/.systemPrefs/.system.lock)
|
|
- macro: rabbitmq_writing_conf
|
|
condition: (proc.name=rabbitmq-server and fd.directory=/etc/rabbitmq)
|
|
- macro: rook_writing_conf
|
|
condition: (proc.name=toolbox.sh and container.image startswith rook/toolbox
|
|
and fd.directory=/etc/ceph)
|
|
- macro: httpd_writing_conf_logs
|
|
condition: (proc.name=httpd and fd.name startswith /etc/httpd/)
|
|
- macro: mysql_writing_conf
|
|
condition: >
|
|
((proc.name in (start-mysql.sh, run-mysqld) or proc.pname=start-mysql.sh) and
|
|
(fd.name startswith /etc/mysql or fd.directory=/etc/my.cnf.d))
|
|
- macro: redis_writing_conf
|
|
condition: >
|
|
(proc.name in (run-redis, redis-launcher.) and fd.name=/etc/redis.conf or fd.name startswith /etc/redis)
|
|
- macro: openvpn_writing_conf
|
|
condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn)
|
|
- macro: php_handlers_writing_conf
|
|
condition: (proc.name=php_handlers_co and fd.name=/etc/psa/php_versions.json)
|
|
- macro: sed_writing_temp_file
|
|
condition: >
|
|
((proc.aname[3]=cron_start.sh and fd.name startswith /etc/security/sed) or
|
|
(proc.name=sed and (fd.name startswith /etc/apt/sources.list.d/sed or
|
|
fd.name startswith /etc/apt/sed or
|
|
fd.name startswith /etc/apt/apt.conf.d/sed)))
|
|
- macro: cron_start_writing_pam_env
|
|
condition: (proc.cmdline="bash /usr/sbin/start-cron" and fd.name=/etc/security/pam_env.conf)
|
|
- macro: dpkg_scripting
|
|
condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu))
|
|
- macro: user_known_write_etc_conditions
|
|
condition: proc.name=confd
|
|
- macro: write_etc_common
|
|
condition: >
|
|
etc_dir and evt.dir = < and open_write
|
|
and proc_name_exists
|
|
and not proc.name in (passwd_binaries, shadowutils_binaries, sysdigcloud_binaries,
|
|
package_mgmt_binaries, ssl_mgmt_binaries, dhcp_binaries,
|
|
dev_creation_binaries, shell_mgmt_binaries,
|
|
mail_config_binaries,
|
|
sshkit_script_binaries,
|
|
ldconfig.real, ldconfig, confd, gpg, insserv,
|
|
apparmor_parser, update-mime, tzdata.config, tzdata.postinst,
|
|
systemd, systemd-machine, systemd-sysuser,
|
|
debconf-show, rollerd, bind9.postinst, sv,
|
|
gen_resolvconf., update-ca-certi, certbot, runsv,
|
|
qualys-cloud-ag, locales.postins, nomachine_binaries,
|
|
adclient, certutil, crlutil, pam-auth-update, parallels_insta,
|
|
openshift-launc, update-rc.d)
|
|
and not proc.pname in (sysdigcloud_binaries, mail_config_binaries, hddtemp.postins, sshkit_script_binaries, locales.postins, deb_binaries, dhcp_binaries)
|
|
and not fd.name pmatch (safe_etc_dirs)
|
|
and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc)
|
|
and not sed_temporary_file
|
|
and not exe_running_docker_save
|
|
and not ansible_running_python
|
|
and not python_running_denyhosts
|
|
and not fluentd_writing_conf_files
|
|
and not user_known_write_etc_conditions
|
|
and not run_by_centrify
|
|
and not run_by_adclient
|
|
and not qualys_writing_conf_files
|
|
and not git_writing_nssdb
|
|
and not plesk_writing_keys
|
|
and not plesk_install_writing_apache_conf
|
|
and not plesk_running_mktemp
|
|
and not networkmanager_writing_resolv_conf
|
|
and not run_by_chef
|
|
and not add_shell_writing_shells_tmp
|
|
and not duply_writing_exclude_files
|
|
and not xmlcatalog_writing_files
|
|
and not parent_supervise_running_multilog
|
|
and not supervise_writing_status
|
|
and not pki_realm_writing_realms
|
|
and not htpasswd_writing_passwd
|
|
and not lvprogs_writing_conf
|
|
and not ovsdb_writing_openvswitch
|
|
and not datadog_writing_conf
|
|
and not curl_writing_pki_db
|
|
and not haproxy_writing_conf
|
|
and not java_writing_conf
|
|
and not dpkg_scripting
|
|
and not parent_ucf_writing_conf
|
|
and not rabbitmq_writing_conf
|
|
and not rook_writing_conf
|
|
and not php_handlers_writing_conf
|
|
and not sed_writing_temp_file
|
|
and not cron_start_writing_pam_env
|
|
and not httpd_writing_conf_logs
|
|
and not mysql_writing_conf
|
|
and not openvpn_writing_conf
|
|
and not consul_template_writing_conf
|
|
and not countly_writing_nginx_conf
|
|
and not ms_oms_writing_conf
|
|
and not ms_scx_writing_conf
|
|
and not azure_scripts_writing_conf
|
|
and not azure_networkwatcher_writing_conf
|
|
and not couchdb_writing_conf
|
|
and not update_texmf_writing_conf
|
|
and not slapadd_writing_conf
|
|
and not symantec_writing_conf
|
|
and not liveupdate_writing_conf
|
|
and not sosreport_writing_files
|
|
and not selinux_writing_conf
|
|
and not veritas_writing_config
|
|
and not nginx_writing_conf
|
|
and not nginx_writing_certs
|
|
and not chef_client_writing_conf
|
|
and not centrify_writing_krb
|
|
and not cockpit_writing_conf
|
|
and not ipsec_writing_conf
|
|
and not httpd_writing_ssl_conf
|
|
and not userhelper_writing_etc_security
|
|
and not pkgmgmt_progs_writing_pki
|
|
and not update_ca_trust_writing_pki
|
|
and not brandbot_writing_os_release
|
|
and not redis_writing_conf
|
|
and not openldap_writing_conf
|
|
and not ucpagent_writing_conf
|
|
and not iscsi_writing_conf
|
|
- rule: Write below etc
|
|
desc: an attempt to write to any file below /etc
|
|
condition: write_etc_common
|
|
output: "File below /etc opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name program=%proc.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])"
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- list: known_root_files
|
|
items: [/root/.monit.state, /root/.auth_tokens, /root/.bash_history, /root/.ash_history, /root/.aws/credentials,
|
|
/root/.viminfo.tmp, /root/.lesshst, /root/.bzr.log, /root/.gitconfig.lock, /root/.babel.json, /root/.localstack,
|
|
/root/.node_repl_history, /root/.mongorc.js, /root/.dbshell, /root/.augeas/history, /root/.rnd, /root/.wget-hsts]
|
|
- list: known_root_directories
|
|
items: [/root/.oracle_jre_usage, /root/.ssh, /root/.subversion, /root/.nami]
|
|
- macro: known_root_conditions
|
|
condition: (fd.name startswith /root/orcexec.
|
|
or fd.name startswith /root/.m2
|
|
or fd.name startswith /root/.npm
|
|
or fd.name startswith /root/.pki
|
|
or fd.name startswith /root/.ivy2
|
|
or fd.name startswith /root/.config/Cypress
|
|
or fd.name startswith /root/.config/pulse
|
|
or fd.name startswith /root/.config/configstore
|
|
or fd.name startswith /root/jenkins/workspace
|
|
or fd.name startswith /root/.jenkins
|
|
or fd.name startswith /root/.cache
|
|
or fd.name startswith /root/.sbt
|
|
or fd.name startswith /root/.java
|
|
or fd.name startswith /root/.glide
|
|
or fd.name startswith /root/.sonar
|
|
or fd.name startswith /root/.v8flag
|
|
or fd.name startswith /root/infaagent
|
|
or fd.name startswith /root/.local/lib/python
|
|
or fd.name startswith /root/.pm2
|
|
or fd.name startswith /root/.gnupg
|
|
or fd.name startswith /root/.pgpass
|
|
or fd.name startswith /root/.theano
|
|
or fd.name startswith /root/.gradle
|
|
or fd.name startswith /root/.android
|
|
or fd.name startswith /root/.ansible
|
|
or fd.name startswith /root/.crashlytics
|
|
or fd.name startswith /root/.dbus
|
|
or fd.name startswith /root/.composer
|
|
or fd.name startswith /root/.gconf
|
|
or fd.name startswith /root/.nv
|
|
or fd.name startswith /root/.local/share/jupyter
|
|
or fd.name startswith /root/oradiag_root
|
|
or fd.name startswith /root/workspace
|
|
or fd.name startswith /root/jvm
|
|
or fd.name startswith /root/.node-gyp)
|
|
- rule: Write below root
|
|
desc: an attempt to write to any file directly below / or /root
|
|
condition: >
|
|
root_dir and evt.dir = < and open_write
|
|
and not fd.name in (known_root_files)
|
|
and not fd.directory in (known_root_directories)
|
|
and not exe_running_docker_save
|
|
and not gugent_writing_guestagent_log
|
|
and not dse_writing_tmp
|
|
and not zap_writing_state
|
|
and not airflow_writing_state
|
|
and not rpm_writing_root_rpmdb
|
|
and not maven_writing_groovy
|
|
and not known_root_conditions
|
|
output: "File below / or /root opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname file=%fd.name program=%proc.name)"
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- macro: cmp_cp_by_passwd
|
|
condition: proc.name in (cmp, cp) and proc.pname in (passwd, run-parts)
|
|
- rule: Read sensitive file trusted after startup
|
|
desc: >
|
|
an attempt to read any sensitive file (e.g. files containing user/password/authentication
|
|
information) by a trusted program after startup. Trusted programs might read these files
|
|
at startup to load initial state, but not afterwards.
|
|
condition: sensitive_files and open_read and server_procs and not proc_is_new and proc.name!="sshd"
|
|
output: >
|
|
Sensitive file opened for reading by trusted program after startup (user=%user.name
|
|
command=%proc.cmdline parent=%proc.pname file=%fd.name parent=%proc.pname gparent=%proc.aname[2])
|
|
priority: WARNING
|
|
tags: [filesystem]
|
|
- list: read_sensitive_file_binaries
|
|
items: [
|
|
iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,
|
|
vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,
|
|
pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport,
|
|
scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd
|
|
]
|
|
- macro: user_read_sensitive_file_conditions
|
|
condition: cmp_cp_by_passwd
|
|
- rule: Read sensitive file untrusted
|
|
desc: >
|
|
an attempt to read any sensitive file (e.g. files containing user/password/authentication
|
|
information). Exceptions are made for known trusted programs.
|
|
condition: >
|
|
sensitive_files and open_read
|
|
and proc_name_exists
|
|
and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,
|
|
cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,
|
|
vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,
|
|
in.proftpd, mandb, salt-minion, postgres_mgmt_binaries)
|
|
and not cmp_cp_by_passwd
|
|
and not ansible_running_python
|
|
and not proc.cmdline contains /usr/bin/mandb
|
|
and not run_by_qualys
|
|
and not run_by_chef
|
|
and not user_read_sensitive_file_conditions
|
|
and not perl_running_plesk
|
|
and not perl_running_updmap
|
|
and not veritas_driver_script
|
|
and not perl_running_centrifydc
|
|
output: >
|
|
Sensitive file opened for reading by non-trusted program (user=%user.name program=%proc.name
|
|
command=%proc.cmdline file=%fd.name parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])
|
|
priority: WARNING
|
|
tags: [filesystem]
|
|
- rule: Write below rpm database
|
|
desc: an attempt to write to the rpm database by any non-rpm related program
|
|
condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef
|
|
output: "Rpm database opened for writing by a non-rpm program (command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline)"
|
|
priority: ERROR
|
|
tags: [filesystem, software_mgmt]
|
|
- macro: postgres_running_wal_e
|
|
condition: (proc.pname=postgres and proc.cmdline startswith "sh -c envdir /etc/wal-e.d/env /usr/local/bin/wal-e")
|
|
- macro: redis_running_prepost_scripts
|
|
condition: (proc.aname[2]=redis-server and (proc.cmdline contains "redis-server.post-up.d" or proc.cmdline contains "redis-server.pre-up.d"))
|
|
- macro: rabbitmq_running_scripts
|
|
condition: >
|
|
(proc.pname=beam.smp and
|
|
(proc.cmdline startswith "sh -c exec ps" or
|
|
proc.cmdline startswith "sh -c exec inet_gethost" or
|
|
proc.cmdline= "sh -s unix:cmd" or
|
|
proc.cmdline= "sh -c exec /bin/sh -s unix:cmd 2>&1"))
|
|
- macro: rabbitmqctl_running_scripts
|
|
condition: (proc.aname[2]=rabbitmqctl and proc.cmdline startswith "sh -c ")
|
|
- macro: run_by_appdynamics
|
|
condition: (proc.pname=java and proc.pcmdline startswith "java -jar -Dappdynamics")
|
|
- rule: DB program spawned process
|
|
desc: >
|
|
a database-server related program spawned a new process other than itself.
|
|
This shouldn\'t occur and is a follow on from some SQL injection attacks.
|
|
condition: >
|
|
proc.pname in (db_server_binaries)
|
|
and spawned_process
|
|
and not proc.name in (db_server_binaries)
|
|
and not postgres_running_wal_e
|
|
output: >
|
|
Database-related program spawned process other than itself (user=%user.name
|
|
program=%proc.cmdline parent=%proc.pname)
|
|
priority: NOTICE
|
|
tags: [process, database]
|
|
- rule: Modify binary dirs
|
|
desc: an attempt to modify any file below a set of binary directories.
|
|
condition: (bin_dir_rename) and modify and not package_mgmt_procs and not exe_running_docker_save
|
|
output: >
|
|
File below known binary directory renamed/removed (user=%user.name command=%proc.cmdline
|
|
pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args)
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- rule: Mkdir binary dirs
|
|
desc: an attempt to create a directory below a set of binary directories.
|
|
condition: mkdir and bin_dir_mkdir and not package_mgmt_procs
|
|
output: >
|
|
Directory below known binary directory created (user=%user.name
|
|
command=%proc.cmdline directory=%evt.arg.path)
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- list: user_known_change_thread_namespace_binaries
|
|
items: []
|
|
- rule: Change thread namespace
|
|
desc: >
|
|
an attempt to change a program/thread\'s namespace (commonly done
|
|
as a part of creating a container) by calling setns.
|
|
condition: >
|
|
evt.type = setns
|
|
and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter)
|
|
and not proc.name in (user_known_change_thread_namespace_binaries)
|
|
and not proc.name startswith "runc:"
|
|
and not proc.pname in (sysdigcloud_binaries)
|
|
and not java_running_sdjagent
|
|
and not kubelet_running_loopback
|
|
output: >
|
|
Namespace change (setns) by unexpected program (user=%user.name command=%proc.cmdline
|
|
parent=%proc.pname %container.info)
|
|
priority: NOTICE
|
|
tags: [process]
|
|
- list: protected_shell_spawning_binaries
|
|
items: [
|
|
http_server_binaries, db_server_binaries, nosql_server_binaries, mail_binaries,
|
|
fluentd, flanneld, splunkd, consul, smbd, runsv, PM2
|
|
]
|
|
- macro: parent_java_running_elasticsearch
|
|
condition: (proc.pname=java and proc.pcmdline contains org.elasticsearch.bootstrap.Elasticsearch)
|
|
- macro: parent_java_running_activemq
|
|
condition: (proc.pname=java and proc.pcmdline contains activemq.jar)
|
|
- macro: parent_java_running_cassandra
|
|
condition: (proc.pname=java and (proc.pcmdline contains "-Dcassandra.config.loader" or proc.pcmdline contains org.apache.cassandra.service.CassandraDaemon))
|
|
- macro: parent_java_running_jboss_wildfly
|
|
condition: (proc.pname=java and proc.pcmdline contains org.jboss)
|
|
- macro: parent_java_running_glassfish
|
|
condition: (proc.pname=java and proc.pcmdline contains com.sun.enterprise.glassfish)
|
|
- macro: parent_java_running_hadoop
|
|
condition: (proc.pname=java and proc.pcmdline contains org.apache.hadoop)
|
|
- macro: parent_java_running_datastax
|
|
condition: (proc.pname=java and proc.pcmdline contains com.datastax)
|
|
- macro: nginx_starting_nginx
|
|
condition: (proc.pname=nginx and proc.cmdline contains "/usr/sbin/nginx -c /etc/nginx/nginx.conf")
|
|
- macro: nginx_running_aws_s3_cp
|
|
condition: (proc.pname=nginx and proc.cmdline startswith "sh -c /usr/local/bin/aws s3 cp")
|
|
- macro: consul_running_net_scripts
|
|
condition: (proc.pname=consul and (proc.cmdline startswith "sh -c curl" or proc.cmdline startswith "sh -c nc"))
|
|
- macro: consul_running_alert_checks
|
|
condition: (proc.pname=consul and proc.cmdline startswith "sh -c /bin/consul-alerts")
|
|
- macro: serf_script
|
|
condition: (proc.cmdline startswith "sh -c serf")
|
|
- macro: check_process_status
|
|
condition: (proc.cmdline startswith "sh -c kill -0 ")
|
|
- macro: possibly_node_in_container
|
|
condition: (never_true and (proc.pname=node and proc.aname[3]=docker-containe))
|
|
- macro: possibly_parent_java_running_tomcat
|
|
condition: (never_true and proc.pname=java and proc.pcmdline contains org.apache.catalina.startup.Bootstrap)
|
|
- macro: protected_shell_spawner
|
|
condition: >
|
|
(proc.aname in (protected_shell_spawning_binaries)
|
|
or parent_java_running_elasticsearch
|
|
or parent_java_running_activemq
|
|
or parent_java_running_cassandra
|
|
or parent_java_running_jboss_wildfly
|
|
or parent_java_running_glassfish
|
|
or parent_java_running_hadoop
|
|
or parent_java_running_datastax
|
|
or possibly_parent_java_running_tomcat
|
|
or possibly_node_in_container)
|
|
- list: mesos_shell_binaries
|
|
items: [mesos-docker-ex, mesos-slave, mesos-health-ch]
|
|
- rule: Run shell untrusted
|
|
desc: an attempt to spawn a shell below a non-shell application. Specific applications are monitored.
|
|
condition: >
|
|
spawned_process
|
|
and shell_procs
|
|
and proc.pname exists
|
|
and protected_shell_spawner
|
|
and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,
|
|
needrestart_binaries,
|
|
mesos_shell_binaries,
|
|
erl_child_setup, exechealthz,
|
|
PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,
|
|
lb-controller, nvidia-installe, runsv, statsite, erlexec)
|
|
and not proc.cmdline in (known_shell_spawn_cmdlines)
|
|
and not proc.aname in (unicorn_launche)
|
|
and not consul_running_net_scripts
|
|
and not consul_running_alert_checks
|
|
and not nginx_starting_nginx
|
|
and not nginx_running_aws_s3_cp
|
|
and not run_by_package_mgmt_binaries
|
|
and not serf_script
|
|
and not check_process_status
|
|
and not run_by_foreman
|
|
and not python_mesos_marathon_scripting
|
|
and not splunk_running_forwarder
|
|
and not postgres_running_wal_e
|
|
and not redis_running_prepost_scripts
|
|
and not rabbitmq_running_scripts
|
|
and not rabbitmqctl_running_scripts
|
|
and not run_by_appdynamics
|
|
and not user_shell_container_exclusions
|
|
output: >
|
|
Shell spawned by untrusted binary (user=%user.name shell=%proc.name parent=%proc.pname
|
|
cmdline=%proc.cmdline pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3]
|
|
aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7])
|
|
priority: DEBUG
|
|
tags: [shell]
|
|
- macro: trusted_containers
|
|
condition: (container.image startswith sysdig/agent or
|
|
(container.image startswith sysdig/falco and
|
|
not container.image startswith sysdig/falco-event-generator) or
|
|
container.image startswith quay.io/sysdig or
|
|
container.image startswith sysdig/sysdig or
|
|
container.image startswith k8s.gcr.io/hyperkube or
|
|
container.image startswith quay.io/coreos/flannel or
|
|
container.image startswith k8s.gcr.io/kube-proxy or
|
|
container.image startswith calico/node or
|
|
container.image startswith rook/toolbox or
|
|
container.image startswith registry.access.redhat.com/openshift3/logging-fluentd or
|
|
container.image startswith registry.access.redhat.com/openshift3/logging-elasticsearch or
|
|
container.image startswith registry.access.redhat.com/openshift3/metrics-cassandra or
|
|
container.image startswith openshift3/ose-sti-builder or
|
|
container.image startswith registry.access.redhat.com/openshift3/ose-sti-builder or
|
|
container.image startswith registry.access.redhat.com/openshift3/ose-docker-builder or
|
|
container.image startswith registry.access.redhat.com/openshift3/image-inspector or
|
|
container.image startswith cloudnativelabs/kube-router or
|
|
container.image startswith "consul:" or
|
|
container.image startswith mesosphere/mesos-slave or
|
|
container.image startswith istio/proxy_ or
|
|
container.image startswith datadog/docker-dd-agent or
|
|
container.image startswith datadog/agent or
|
|
container.image startswith docker/ucp-agent or
|
|
container.image startswith gliderlabs/logspout)
|
|
- macro: user_trusted_containers
|
|
condition: (container.image startswith sysdig/agent)
|
|
- macro: user_sensitive_mount_containers
|
|
condition: (container.image startswith sysdig/agent)
|
|
- rule: Launch Privileged Container
|
|
desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images.
|
|
condition: >
|
|
evt.type=execve and proc.vpid=1 and container
|
|
and container.privileged=true
|
|
and not trusted_containers
|
|
and not user_trusted_containers
|
|
output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image)
|
|
priority: INFO
|
|
tags: [container, cis]
|
|
- macro: sensitive_mount
|
|
condition: (container.mount.dest[/proc*] != "N/A" or
|
|
container.mount.dest[/var/run/docker.sock] != "N/A" or
|
|
container.mount.dest[/] != "N/A" or
|
|
container.mount.dest[/etc] != "N/A" or
|
|
container.mount.dest[/root*] != "N/A")
|
|
- macro: container_entrypoint
|
|
condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe))
|
|
- rule: Launch Sensitive Mount Container
|
|
desc: >
|
|
Detect the initial process started by a container that has a mount from a sensitive host directory
|
|
(i.e. /proc). Exceptions are made for known trusted images.
|
|
condition: >
|
|
evt.type=execve and proc.vpid=1 and container
|
|
and sensitive_mount
|
|
and not trusted_containers
|
|
and not user_sensitive_mount_containers
|
|
output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image mounts=%container.mounts)
|
|
priority: INFO
|
|
tags: [container, cis]
|
|
- macro: allowed_containers
|
|
condition: (proc.vpid=1)
|
|
- rule: Launch Disallowed Container
|
|
desc: >
|
|
Detect the initial process started by a container that is not in a list of allowed containers.
|
|
condition: evt.type=execve and proc.vpid=1 and container and not allowed_containers
|
|
output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image)
|
|
priority: WARNING
|
|
tags: [container]
|
|
- rule: System user interactive
|
|
desc: an attempt to run interactive commands by a system (i.e. non-login) user
|
|
condition: spawned_process and system_users and interactive
|
|
output: "System user ran an interactive command (user=%user.name command=%proc.cmdline)"
|
|
priority: INFO
|
|
tags: [users]
|
|
- rule: Terminal shell in container
|
|
desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
|
|
condition: >
|
|
spawned_process and container
|
|
and shell_procs and proc.tty != 0
|
|
and container_entrypoint
|
|
output: >
|
|
A shell was spawned in a container with an attached terminal (user=%user.name %container.info
|
|
shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty)
|
|
priority: NOTICE
|
|
tags: [container, shell]
|
|
- list: known_shell_spawn_cmdlines
|
|
items: [
|
|
'"sh -c uname -p 2> /dev/null"',
|
|
'"sh -c uname -s 2>&1"',
|
|
'"sh -c uname -r 2>&1"',
|
|
'"sh -c uname -v 2>&1"',
|
|
'"sh -c uname -a 2>&1"',
|
|
'"sh -c ruby -v 2>&1"',
|
|
'"sh -c getconf CLK_TCK"',
|
|
'"sh -c getconf PAGESIZE"',
|
|
'"sh -c LC_ALL=C LANG=C /sbin/ldconfig -p 2>/dev/null"',
|
|
'"sh -c LANG=C /sbin/ldconfig -p 2>/dev/null"',
|
|
'"sh -c /sbin/ldconfig -p 2>/dev/null"',
|
|
'"sh -c stty -a 2>/dev/null"',
|
|
'"sh -c stty -a < /dev/tty"',
|
|
'"sh -c stty -g < /dev/tty"',
|
|
'"sh -c node index.js"',
|
|
'"sh -c node index"',
|
|
'"sh -c node ./src/start.js"',
|
|
'"sh -c node app.js"',
|
|
'"sh -c node -e \"require(''nan'')\""',
|
|
'"sh -c node -e \"require(''nan'')\")"',
|
|
'"sh -c node $NODE_DEBUG_OPTION index.js "',
|
|
'"sh -c crontab -l 2"',
|
|
'"sh -c lsb_release -a"',
|
|
'"sh -c lsb_release -is 2>/dev/null"',
|
|
'"sh -c whoami"',
|
|
'"sh -c node_modules/.bin/bower-installer"',
|
|
'"sh -c /bin/hostname -f 2> /dev/null"',
|
|
'"sh -c locale -a"',
|
|
'"sh -c -t -i"',
|
|
'"sh -c openssl version"',
|
|
'"bash -c id -Gn kafadmin"',
|
|
'"sh -c /bin/sh -c ''date +%%s''"'
|
|
]
|
|
- list: user_known_shell_spawn_binaries
|
|
items: []
|
|
- macro: user_shell_container_exclusions
|
|
condition: (never_true)
|
|
- macro: login_doing_dns_lookup
|
|
condition: (proc.name=login and fd.l4proto=udp and fd.sport=53)
|
|
- rule: System procs network activity
|
|
desc: any network activity performed by system binaries that are not expected to send or receive any network traffic
|
|
condition: >
|
|
(fd.sockfamily = ip and system_procs)
|
|
and (inbound_outbound)
|
|
and not proc.name in (systemd, hostid, id)
|
|
and not login_doing_dns_lookup
|
|
output: >
|
|
Known system binary sent/received network traffic
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name)
|
|
priority: NOTICE
|
|
tags: [network]
|
|
- list: openvpn_udp_ports
|
|
items: [1194, 1197, 1198, 8080, 9201]
|
|
- list: l2tp_udp_ports
|
|
items: [500, 1701, 4500, 10000]
|
|
- list: statsd_ports
|
|
items: [8125]
|
|
- list: ntp_ports
|
|
items: [123]
|
|
- list: test_connect_ports
|
|
items: [0, 9, 80, 3306]
|
|
- macro: do_unexpected_udp_check
|
|
condition: (never_true)
|
|
- list: expected_udp_ports
|
|
items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]
|
|
- macro: expected_udp_traffic
|
|
condition: fd.port in (expected_udp_ports)
|
|
- rule: Unexpected UDP Traffic
|
|
desc: UDP traffic not on port 53 (DNS) or other commonly used ports
|
|
condition: (inbound_outbound) and do_unexpected_udp_check and fd.l4proto=udp and not expected_udp_traffic
|
|
output: >
|
|
Unexpected UDP Traffic Seen
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name proto=%fd.l4proto evt=%evt.type %evt.args)
|
|
priority: NOTICE
|
|
tags: [network]
|
|
- macro: somebody_becoming_themself
|
|
condition: ((user.name=nobody and evt.arg.uid=nobody) or
|
|
(user.name=www-data and evt.arg.uid=www-data) or
|
|
(user.name=_apt and evt.arg.uid=_apt) or
|
|
(user.name=postfix and evt.arg.uid=postfix) or
|
|
(user.name=pki-agent and evt.arg.uid=pki-agent) or
|
|
(user.name=pki-acme and evt.arg.uid=pki-acme) or
|
|
(user.name=nfsnobody and evt.arg.uid=nfsnobody) or
|
|
(user.name=postgres and evt.arg.uid=postgres))
|
|
- macro: nrpe_becoming_nagios
|
|
condition: (proc.name=nrpe and evt.arg.uid=nagios)
|
|
- macro: known_user_in_container
|
|
condition: (container and user.name != "N/A")
|
|
- rule: Non sudo setuid
|
|
desc: >
|
|
an attempt to change users by calling setuid. sudo/su are excluded. users "root" and "nobody"
|
|
suing to itself are also excluded, as setuid calls typically involve dropping privileges.
|
|
condition: >
|
|
evt.type=setuid and evt.dir=>
|
|
and (known_user_in_container or not container)
|
|
and not user.name=root and not somebody_becoming_themself
|
|
and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,
|
|
nomachine_binaries)
|
|
and not java_running_sdjagent
|
|
and not nrpe_becoming_nagios
|
|
output: >
|
|
Unexpected setuid call by non-sudo, non-root program (user=%user.name cur_uid=%user.uid parent=%proc.pname
|
|
command=%proc.cmdline uid=%evt.arg.uid)
|
|
priority: NOTICE
|
|
tags: [users]
|
|
- rule: User mgmt binaries
|
|
desc: >
|
|
activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded.
|
|
Activity in containers is also excluded--some containers create custom users on top
|
|
of a base linux distribution at startup.
|
|
Some innocuous commandlines that don't actually change anything are excluded.
|
|
condition: >
|
|
spawned_process and proc.name in (user_mgmt_binaries) and
|
|
not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not container and
|
|
not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and
|
|
not proc.cmdline startswith "passwd -S" and
|
|
not proc.cmdline startswith "useradd -D" and
|
|
not proc.cmdline startswith "systemd --version" and
|
|
not run_by_qualys and
|
|
not run_by_sumologic_securefiles and
|
|
not run_by_yum and
|
|
not run_by_ms_oms and
|
|
not run_by_google_accounts_daemon
|
|
output: >
|
|
User management binary command run outside of container
|
|
(user=%user.name command=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])
|
|
priority: NOTICE
|
|
tags: [host, users]
|
|
- list: allowed_dev_files
|
|
items: [
|
|
/dev/null, /dev/stdin, /dev/stdout, /dev/stderr,
|
|
/dev/random, /dev/urandom, /dev/console, /dev/kmsg
|
|
]
|
|
- rule: Create files below dev
|
|
desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev.
|
|
condition: >
|
|
fd.directory = /dev and
|
|
(evt.type = creat or (evt.type = open and evt.arg.flags contains O_CREAT))
|
|
and not proc.name in (dev_creation_binaries)
|
|
and not fd.name in (allowed_dev_files)
|
|
and not fd.name startswith /dev/tty
|
|
output: "File created below /dev by untrusted program (user=%user.name command=%proc.cmdline file=%fd.name)"
|
|
priority: ERROR
|
|
tags: [filesystem]
|
|
- macro: ec2_metadata_containers
|
|
condition: container
|
|
- rule: Contact EC2 Instance Metadata Service From Container
|
|
desc: Detect attempts to contact the EC2 Instance Metadata Service from a container
|
|
condition: outbound and fd.sip="169.254.169.254" and container and not ec2_metadata_containers
|
|
output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image)
|
|
priority: NOTICE
|
|
tags: [network, aws, container]
|
|
- macro: k8s_api_server
|
|
condition: (fd.sip="1.2.3.4" and fd.sport=8080)
|
|
- macro: k8s_containers
|
|
condition: >
|
|
(container.image startswith k8s.gcr.io/hyperkube-amd64 or
|
|
container.image startswith k8s.gcr.io/kube2sky or
|
|
container.image startswith sysdig/agent or
|
|
container.image startswith sysdig/falco or
|
|
container.image startswith sysdig/sysdig)
|
|
- rule: Contact K8S API Server From Container
|
|
desc: Detect attempts to contact the K8S API Server from a container
|
|
condition: outbound and k8s_api_server and container and not k8s_containers
|
|
output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image connection=%fd.name)
|
|
priority: NOTICE
|
|
tags: [network, k8s, container]
|
|
- macro: nodeport_containers
|
|
condition: container
|
|
- rule: Unexpected K8s NodePort Connection
|
|
desc: Detect attempts to use K8s NodePorts from a container
|
|
condition: (inbound_outbound) and fd.sport >= 30000 and fd.sport <= 32767 and container and not nodeport_containers
|
|
output: Unexpected K8s NodePort Connection (command=%proc.cmdline connection=%fd.name)
|
|
priority: NOTICE
|
|
tags: [network, k8s, container]
|
|
|
|
falco_rules_local: |
|
|
####################
|
|
# Your custom rules!
|
|
####################
|
|
|
|
# Add new rules, like this one
|
|
# - rule: The program "sudo" is run in a container
|
|
# desc: An event will trigger every time you run sudo in a container
|
|
# condition: evt.type = execve and evt.dir=< and container.id != host and proc.name = sudo
|
|
# output: "Sudo run in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)"
|
|
# priority: ERROR
|
|
# tags: [users, container]
|
|
|
|
# Or override/append to any rule, macro, or list from the Default Rules
|
|
custom_rules: {}
|
|
# Although Falco comes with a nice default rule set for detecting weird
|
|
# behavior in containers, our users are going to customize the run-time
|
|
# security rule sets or policies for the specific container images and
|
|
# applications they run. This feature can be handled in this section.
|
|
#
|
|
# Example:
|
|
#
|
|
# rules-traefik.yaml: |-
|
|
# [ rule body ]
|
|
|
|
dependencies:
|
|
dynamic:
|
|
common:
|
|
local_image_registry:
|
|
jobs:
|
|
- k8sksauth-image-repo-sync
|
|
services:
|
|
- endpoint: node
|
|
service: local_image_registry
|
|
static:
|
|
falco:
|
|
services: null
|
|
image_repo_sync:
|
|
services:
|
|
- endpoint: internal
|
|
service: local_image_registry
|
|
|
|
manifests:
|
|
daemonset: true
|
|
configmap_etc: true
|
|
configmap_custom_rules: false
|
|
configmap_bin: true
|
|
secret_registry: true
|
|
...
|