Threat Detection

Threat detection feature is based on Falco, Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. It leverages custom rules on Linux kernel events and other data sources through plugins, enriching event data with contextual metadata to deliver real-time alerts. Falco enables the detection of abnormal behavior, potential security threats, and compliance violations.

Default rules

maturity	rule	desc	workload	mitre_phase	mitre_ttp	extra_tags	compliance_pci_dss	compliance_nist	enabled
maturity_stable	Clear Log Activities	Detect clearing of critical access log files, typically done to erase evidence that could be attributed to an adversary's actions. To effectively customize and operationalize this detection, check for potentially missing log file destinations relevant to your environment, and adjust the profiled containers you wish not to be alerted on.	container, host	mitre_defense_evasion	T1070	filesystem		NIST_800-53_AU-10	TRUE
maturity_stable	Contact K8S API Server From Container	Detect attempts to communicate with the K8S API Server from a container by non-profiled users. Kubernetes APIs play a pivotal role in configuring the cluster management lifecycle. Detecting potential unauthorized access to the API server is of utmost importance. Audit your complete infrastructure and pinpoint any potential machines from which the API server might be accessible based on your network layout. If Falco can't operate on all these machines, consider analyzing the Kubernetes audit logs (typically drained from control nodes, and Falco offers a k8saudit plugin) as an additional data source for detections within the control plane.	container	mitre_discovery	T1565	network, k8s			TRUE
maturity_stable	Create Hardlink Over Sensitive Files	Detect hardlink created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule ""Read sensitive file untrusted"".	container, host	mitre_credential_access	T1555	filesystem			TRUE
maturity_stable	Create Symlink Over Sensitive Files	Detect symlinks created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule ""Read sensitive file untrusted"".	container, host	mitre_credential_access	T1555	filesystem			TRUE
maturity_stable	Debugfs Launched in Privileged Container	Detect file system debugger debugfs launched inside a privileged container which might lead to container escape. This rule has a more narrow scope.	container	mitre_privilege_escalation	T1611	cis, process			TRUE
maturity_stable	Detect release_agent File Container Escapes	Detect an attempt to exploit a container escape using release_agent file. By running a container with certains capabilities, a privileged user can modify release_agent file and escape from the container.	container	mitre_privilege_escalation	T1611	process			TRUE
maturity_stable	Directory traversal monitored file read	Web applications can be vulnerable to directory traversal attacks that allow accessing files outside of the web app's root directory (e.g. Arbitrary File Read bugs). System directories like /etc are typically accessed via absolute paths. Access patterns outside of this (here path traversal) can be regarded as suspicious. This rule includes failed file open attempts.	container, host	mitre_credential_access	T1555	filesystem			TRUE
maturity_stable	Disallowed SSH Connection Non Standard Port	Detect any new outbound SSH connection from the host or container using a non-standard port. This rule holds the potential to detect a family of reverse shells that cause the victim machine to connect back out over SSH, with STDIN piped from the SSH connection to a shell's STDIN, and STDOUT of the shell piped back over SSH. Such an attack can be launched against any app that is vulnerable to command injection. The upstream rule only covers a limited selection of non-standard ports. We suggest adding more ports, potentially incorporating ranges based on your environment's knowledge and custom SSH port configurations. This rule can complement the ""Redirect STDOUT/STDIN to Network Connection in Container"" or ""Disallowed SSH Connection"" rule.	container, host	mitre_execution	T1059	network, process			TRUE
maturity_stable	Drop and execute new binary in container	Detect if an executable not belonging to the base image of a container is being executed. The drop and execute pattern can be observed very often after an attacker gained an initial foothold. is_exe_upper_layer filter field only applies for container runtimes that use overlayfs as union mount filesystem. Adopters can utilize the provided template list known_drop_and_execute_containers containing allowed container images known to execute binaries not included in their base image. Alternatively, you could exclude non-production namespaces in Kubernetes settings by adjusting the rule further. This helps reduce noise by applying application and environment-specific knowledge to this rule. Common anti-patterns include administrators or SREs performing ad-hoc debugging.	container	mitre_persistence	TA0003	process	PCI_DSS_11.5.1		TRUE
maturity_stable	Execution from /dev/shm	This rule detects file execution in the /dev/shm directory, a tactic often used by threat actors to store their readable, writable, and occasionally executable files. /dev/shm acts as a link to the host or other containers, creating vulnerabilities for their compromise as well. Notably, /dev/shm remains unchanged even after a container restart. Consider this rule alongside the newer ""Drop and execute new binary in container"" rule.	container, host	mitre_execution	T1059.004				TRUE
maturity_stable	Fileless execution via memfd_create	Detect if a binary is executed from memory using the memfd_create technique. This is a well-known defense evasion technique for executing malware on a victim machine without storing the payload on disk and to avoid leaving traces about what has been executed. Adopters can whitelist processes that may use fileless execution for benign purposes by adding items to the list known_memfd_execution_processes.	container, host	mitre_defense_evasion	T1620	process			TRUE
maturity_stable	Find AWS Credentials	Detect attempts to search for private keys or passwords using the grep or find command, particularly targeting standard AWS credential locations. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level. This rule complements the rule ""Search Private Keys or Passwords"".	container, host	mitre_credential_access	T1552	process, aws			TRUE
maturity_stable	Linux Kernel Module Injection Detected	Inject Linux Kernel Modules from containers using insmod or modprobe with init_module and finit_module syscalls, given the precondition of sys_module effective capabilities. Profile the environment and consider allowed_container_images_loading_kernel_module to reduce noise and account for legitimate cases.	container, host	mitre_persistence	TA0003	process			TRUE
maturity_stable	Netcat Remote Code Execution in Container	Netcat Program runs inside container that allows remote code execution and may be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/. These programs are of higher relevance as they are commonly installed on UNIX-like operating systems. Can fire in combination with the ""Redirect STDOUT/STDIN to Network Connection in Container"" rule as it utilizes a different evt.type.	container	mitre_execution	T1059	network, process			TRUE
maturity_stable	PTRACE anti-debug attempt	Detect usage of the PTRACE system call with the PTRACE_TRACEME argument, indicating a program actively attempting to avoid debuggers attaching to the process. This behavior is typically indicative of malware activity. Read more about PTRACE in the ""PTRACE attached to process"" rule.	container, host	mitre_defense_evasion	T1622	process			TRUE
maturity_stable	PTRACE attached to process	Detect an attempt to inject potentially malicious code into a process using PTRACE in order to evade process-based defenses or elevate privileges. Common anti-patterns are debuggers. Additionally, profiling your environment via the known_ptrace_procs template macro can reduce noise. A successful ptrace syscall generates multiple logs at once.	container, host	mitre_privilege_escalation	T1055.008	process			TRUE
maturity_stable	Packet socket created in container	Detect new packet socket at the device driver (OSI Layer 2) level in a container. Packet socket could be used for ARP Spoofing and privilege escalation (CVE-2020-14386) by an attacker. Noise can be reduced by using the user_known_packet_socket_binaries template list.	container	mitre_credential_access	T1557.002	network			TRUE
maturity_stable	Read sensitive file trusted after startup	An attempt to read any sensitive file (e.g. files containing user/password/authentication information) by a trusted program after startup. Trusted programs might read these files at startup to load initial state, but not afterwards. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rules for critical application credentials unique to your environment.	container, host	mitre_credential_access	T1555	filesystem			TRUE
maturity_stable	Read sensitive file untrusted	An attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rules for critical application credentials unique to your environment.	container, host	mitre_credential_access	T1555	filesystem			TRUE
maturity_stable	Redirect STDOUT/STDIN to Network Connection in Container	Detect redirection of stdout/stdin to a network connection within a container, achieved by utilizing a variant of the dup syscall (potential reverse shell or remote code execution https://github.com/swisskyrepo/PayloadsAllTheThings/). This detection is behavior-based and may generate noise in the system, and can be adjusted using the user_known_stand_streams_redirect_activities template macro. Tuning can be performed similarly to existing detections based on process lineage or container images, and/or it can be limited to interactive tty (tty != 0).	container	mitre_execution	T1059	network, process			TRUE
maturity_stable	Remove Bulk Data from Disk	Detect a process running to clear bulk data from disk with the intention to destroy data, possibly interrupting availability to systems. Profile your environment and use user_known_remove_data_activities to tune this rule.	container, host	mitre_impact	T1485	process, filesystem			TRUE
maturity_stable	Run shell untrusted	An attempt to spawn a shell below a non-shell application. The non-shell applications that are monitored are defined in the protected_shell_spawner macro, with protected_shell_spawning_binaries being the list you can easily customize. For Java parent processes, please note that Java often has a custom process name. Therefore, rely more on proc.exe to define Java applications. This rule can be noisier, as you can see in the exhaustive existing tuning. However, given it is very behavior-driven and broad, it is universally relevant to catch general Remote Code Execution (RCE). Allocate time to tune this rule for your use cases and reduce noise. Tuning suggestions include looking at the duration of the parent process (proc.ppid.duration) to define your long-running app processes. Checking for newer fields such as proc.vpgid.name and proc.vpgid.exe instead of the direct parent process being a non-shell application could make the rule more robust.	container, host	mitre_execution	T1059.004	process, shell			TRUE
maturity_stable	Search Private Keys or Passwords	Detect attempts to search for private keys or passwords using the grep or find command. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level.	container, host	mitre_credential_access	T1552.001	process, filesystem			TRUE
maturity_stable	System user interactive	System (e.g. non-login) users spawning new processes. Can add custom service users (e.g. apache or mysqld). 'Interactive' is defined as new processes as descendants of an ssh session or login process. Consider further tuning by only looking at processes in a terminal / tty (proc.tty != 0). A newer field proc.is_vpgid_leader could be of help to distinguish if the process was ""directly"" executed, for instance, in a tty, or executed as a descendant process in the same process group, which, for example, is the case when subprocesses are spawned from a script. Consider this rule as a great template rule to monitor interactive accesses to your systems more broadly. However, such a custom rule would be unique to your environment. The rule ""Terminal shell in container"" that fires when using ""kubectl exec"" is more Kubernetes relevant, whereas this one could be more interesting for the underlying host.	container, host	mitre_execution	T1059	users		NIST_800-53_AC-2	TRUE
maturity_stable	Terminal shell in container	A shell was used as the entrypoint/exec point into a container with an attached terminal. Parent process may have legitimately already exited and be null (read container_entrypoint macro). Common when using ""kubectl exec"" in Kubernetes. Correlate with k8saudit exec logs if possible to find user or serviceaccount token used (fuzzy correlation by namespace and pod name). Rather than considering it a standalone rule, it may be best used as generic auditing rule while examining other triggered rules in this container/tty.	container	mitre_execution	T1059	shell			TRUE

Optional rules

maturity	rule	desc	workload	mitre_phase	mitre_ttp	extra_tags	compliance_pci_dss	compliance_nist	enabled
maturity_incubating	Adding ssh keys to authorized_keys	After gaining access, attackers can modify the authorized_keys file to maintain persistence on a victim host. Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. This rules aims at detecting any modification to the authorized_keys file, that is usually located under the .ssh directory in any user's home directory. This rule complements the more generic auditing rule ""Read ssh information"" by specifically detecting the writing of new, potentially attacker-provided keys.	host	mitre_persistence	T1098.004	filesystem			TRUE
maturity_incubating	BPF Program Not Profiled	BPF is a kernel technology that can be misused for malicious purposes, like ""Linux Kernel Module Injection"". This rule should be considered an auditing rule to notify you of any unprofiled BPF tools running in your environment. However, it requires customization after profiling your environment. BPF-powered agents make bpf syscalls all the time, so this rule only sends logs for BPF_PROG_LOAD calls (bpf cmd=5) in the enter event. If you also want to log whether the syscall failed or succeeded, remove the direction filter and add the evt.arg.res_or_fd output field.	container, host	mitre_persistence	TA0003				TRUE
maturity_incubating	Backdoored library loaded into SSHD (CVE-2024-3094)	This rule detects possible CVE-2024-3094 exploitation when the SSH daemon process loads a vulnerable version of the liblzma library. An attacker could exploit this to interfere with authentication in sshd via systemd, potentially compromising sensitive data or escalating their privileges.	container, host	mitre_initial_access	T1556				TRUE
maturity_incubating	Change namespace privileges via unshare	Unprivileged users in containers may not have CAP_SYS_ADMIN or other elevated privileges. However, they can use the unshare system call with CLONE_NEWNS or CLONE_NEWUSER to create or clone a namespace or user with the necessary privileges to conduct further attacks. It is best practice to block the unshare system call via seccomp if it is not needed. Misuse of unshare can be related to misconfigured Kubernetes clusters, for example.	container	mitre_privilege_escalation	T1611				TRUE
maturity_incubating	Change thread namespace	An attempt to alter the namespace of a process (often performed while creating a container) through the setns syscall. Conversely, the same syscall setns is triggered when an unauthorized attempt is made to break out from the container to the host, for example, when using commands like nsenter --target 1 and similar ones. Recommending to profile your environment and refine this rule for effective operationalization.	container, host	mitre_privilege_escalation	T1611	process			TRUE
maturity_incubating	Contact EC2 Instance Metadata Service From Container	Detects attempts to communicate with the EC2 Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.	container	mitre_credential_access	T1552.005	network, aws			TRUE
maturity_incubating	Contact cloud metadata service from container	Detects attempts to communicate with the Cloud Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.	container	mitre_discovery	T1565	network			TRUE
maturity_incubating	Create files below dev	Detect the creation of files under /dev except for authorized device management programs. This can reveal rootkits hiding files in /dev. Additionally, consider the ""Execution from /dev/shm"" rule. The upstream rule already covers some tuning scenarios that you can further expand upon.	host	mitre_persistence	T1543	filesystem			TRUE
maturity_incubating	DB program spawned process	A program related to the database server creates an unexpected child process (other than itself). This is not supposed to happen and often follows SQL injection attacks. This behavioral detection could indicate potential unauthorized data extraction or tampering with the database.	container, host	mitre_execution	T1190	process, database			TRUE
maturity_incubating	Delete or rename shell history	Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. Note that it can also trigger when exiting a Terminal shell, such as with kubectl exec, which may introduce some noise.	container, host	mitre_defense_evasion	T1070	process, filesystem			TRUE
maturity_incubating	Exfiltrating Artifacts via Kubernetes Control Plane	Detect the copying of artifacts from a container's file system using the Kubernetes control plane (kubectl cp). This rule can identify potential exfiltration of application secrets from containers' file systems, potentially revealing the outcomes of unauthorized access and control plane misuse via stolen identities (such as stolen credentials like Kubernetes serviceaccount tokens). Can be customized by the adopter to only monitor specific artifact paths, containers, or namespaces as needed.	container	mitre_exfiltration	TA0010	filesystem			TRUE
maturity_incubating	Launch Excessively Capable Container	Identify containers that start with a powerful set of capabilities, with exceptions for recognized trusted images. Similar to the ""Launch Privileged Container"" rule, this functions as a robust auditing rule. Compromised highly privileged containers can lead to substantial harm. For instance, if another rule is triggered within such a container, it might raise suspicion, prompting closer scrutiny.	container	mitre_execution	T1610	cis			TRUE
maturity_incubating	Launch Ingress Remote File Copy Tools in Container	Detect ingress remote file copy tools (such as curl or wget) launched inside containers. This rule can be considered a valuable auditing tool, but it has the potential to generate notable noise and requires careful profiling before full operationalization.	container	mitre_command_and_control	TA0011	network, process			TRUE
maturity_incubating	Launch Package Management Process in Container	Detect package management processes executed within containers. An excellent auditing rule to monitor general drifts in containers. Particularly useful for newer rules like ""Drop and execute new binary in container"" during incident response investigations. This helps identify common anti-patterns of ad-hoc debugging. Simultaneously, to maintain optimal hygiene, it's recommended to prevent container drifts and instead opt for redeploying new containers.	container	mitre_persistence	T1505	process, software_mgmt			TRUE
maturity_incubating	Launch Privileged Container	Detect the initial process initiation within a privileged container, with exemptions for known and trusted images. This rule primarily serves as an excellent auditing mechanism since highly privileged containers, when compromised, can result in significant harm. For instance, if another rule triggers within such a privileged container, it could be seen as more suspicious, prompting a closer inspection.	container	mitre_execution	T1610	cis	PCI_DSS_10.2.5		TRUE
maturity_incubating	Launch Remote File Copy Tools in Container	Detect remote file copy tools (like rsync, scp, sftp, dcp) launched within a container, potentially indicating data exfiltration. Suggest refining this rule to accommodate legitimate use cases.	container	mitre_exfiltration	T1020	network, process			TRUE
maturity_incubating	Launch Suspicious Network Tool in Container	Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. This rule complements the more specific ""Netcat Remote Code Execution in Container"" rule.	container	mitre_execution	T1059	network, process			TRUE
maturity_incubating	Launch Suspicious Network Tool on Host	Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. The host equivalent of ""Launch Suspicious Network Tool in Container."".	host	mitre_execution	T1059	network, process			TRUE
maturity_incubating	Modify Shell Configuration File	Detect attempts to modify shell configuration files, primarily aimed at establishing persistence by automatically inserting commands into scripts executed by shells. The upstream rule excludes shell processes because they often create unnecessary noise. However, this might lead to missed detections. To customize the rule for your situation, you can fine-tune it using enhanced profiling. For example, you might want to only consider interactive shell processes (where proc.tty != 0).	container, host	mitre_persistence	T1546.004	filesystem			TRUE
maturity_incubating	Mount Launched in Privileged Container	Detect filesystem mounts (using the mount binary) within a privileged container. Due to the elevated privileges, this action could be one of the TTPs used in an attempt to escape from a container to the host. This type of action is often preceded by reconnaissance activities, for which you can also create custom rules.	container	mitre_privilege_escalation	T1611	cis, filesystem			TRUE
maturity_incubating	Network Connection outside Local Subnet	Detect network traffic (inbound or outbound) from a container to a destination outside the local subnet. To operationalize this rule, profile your environment and update the template macro namespace_scope_network_only_subnet. Customizing network-related rules usually demands substantial engineering effort to ensure their functionality.	container	mitre_discovery	T1046	network	PCI_DSS_6.4.2		TRUE
maturity_incubating	Non sudo setuid	Detect attempts to change users through the use of setuid, with exceptions for sudo/su. The users ""root"" and ""nobody"" using setuid on themselves are also excluded, as setuid calls in these cases typically involve reducing privileges. By setting the setuid bit, an attacker could execute code in a different user's context, potentially with higher privileges. One drawback is the potential for noise, as many applications legitimately use this approach.	container, host	mitre_privilege_escalation	T1548.001	users			TRUE
maturity_incubating	Potential Local Privilege Escalation via Environment Variables Misuse	Process run with suspect environment variable that could be attempting privilege escalation. One use case is detecting the use of the GLIBC_TUNABLES environment variable, which could be used for privilege escalation on systems running vulnerable glibc versions. Only known and carefully profiled processes that legitimately exhibit this behavior should be excluded from this rule. This rule is expected to trigger on every attempt, even failed ones.	container, host	mitre_privilege_escalation	TA0004	users			TRUE
maturity_incubating	Program run with disallowed http proxy env	Detect curl or wget usage with HTTP_PROXY environment variable. Attackers can manipulate the HTTP_PROXY variable's value to redirect application's internal HTTP requests. This could expose sensitive information like authentication keys and private data.	container, host	mitre_execution	T1204	users			TRUE
maturity_incubating	Read environment variable from /proc files	An attempt to read process environment variables from /proc files. The consequences are akin to accessing traditional sensitive files, as sensitive data, including secrets, might be stored in environment variables. Understanding your environment, such as identifying critical namespaces, and incorporating extra filtering statements to alert exclusively for those, can enhance the rule's effectiveness.	container	mitre_discovery	T1083	filesystem, process			TRUE
maturity_incubating	Read ssh information	This rule identifies attempts to read files within ssh directories using programs that are not related to ssh. It's a simple and versatile detection method that works well alongside more specific rules focused on sensitive file access. You have a couple of options for using this rule effectively: you can adjust the specialized rules to cover all the important scenarios and ensure precedence in rule smatching for those, or you can analyze the combined view of ssh-related file access across various rules on your downstream computing platform. Just like with other rules, you can narrow down monitoring to specific processes, or you can limit it to interactive access only.	container, host	mitre_collection	T1005	filesystem			TRUE
maturity_incubating	Schedule Cron Jobs	Detect scheduled cron jobs; this is a highly generic detection and certainly needs adjustments and profiling in your environment before operationalization. Simultaneously, exploiting the functionality of cron jobs is among one of the oldest TTPs used by adversaries.	container, host	mitre_execution	T1053.003	filesystem			TRUE
maturity_incubating	Set Setuid or Setgid bit	This rule is focused on detecting the use of setuid or setgid bits set via chmod. These bits, when set for an application, result in the application running with the privileges of the owning user or group. By enabling the setuid or setgid bits, an attacker could run code in a different user's context, possibly with elevated privileges. However, there's a trade-off with noise, given that numerous applications legitimately run chmod. This rule is related to the ""Non sudo setuid"" rule.	container, host	mitre_privilege_escalation	T1548.001	process, users			TRUE
maturity_incubating	System procs network activity	Detect any unexpected network activity performed by system binaries that typically shouldn't perform network activity, including coreutils binaries (like sleep, mkdir, who, date, and others) or user management binaries (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). This serves as a valuable baseline detection for network-related activities.	host	mitre_execution	T1059	network, process			TRUE
maturity_incubating	Unexpected UDP Traffic	Detecting UDP traffic on ports other than 53 (DNS) or other commonly used ports. Misusing UDP is a known TTP among attackers. Monitoring unusual network activity is highly valuable but often generates significant noise, as is the case with this detection.	container, host	mitre_exfiltration	TA0011	network			TRUE
maturity_incubating	User mgmt binaries	Detect activity by any programs that can manage users, passwords, or permissions (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). sudo and su are excluded. Activity in containers is also excluded -- some containers create custom users on top of a base linux distribution at startup. Some innocuous command lines that don't actually change anything are excluded. You might want to consider applying this rule to container actions as well.	host	mitre_persistence	T1098	users, software_mgmt			TRUE