CODEWITHSUNDEEP
dockercontainersalertauditfalco
Harika
Harika

Reputation: 11

How to define a rule to capture alerts when any manual command gets executed inside the container on Falco

Installed Falco drivers on the host.

Able to capture alerts for specific conditions like when there is a process spawned or if any script is getting executed inside the container. But the requirement is to trigger an alert whenever any manual command gets executed inside the container.

Is there any custom condition we use to generate an alert whenever any command gets executed inside a container?

Expecting the below condition should capture an alert whenever command line contains newline char or pressed enter inside a container or the command executed contains any .sh but this didn't work.

- rule: shell_in_container
  desc: notice shell activity within a container
  condition: >
    container.id != host and
    proc.cmdline contains "\n" or
    proc.cmdline endswith ".sh"

  output: >
    shell in a container
    (user=%user.name container_id=%container.id container_name=%container.name
    shell=%proc.name parent=%proc.pname source_ip=%fd.rip  cmdline=%proc.cmdline)
  priority: WARNING

Upvotes: 1

Views: 617

Answers (2)

Harika
Harika

Reputation: 11

Below rule is generating alerts whenever there is a manual command executed inside container (exec with bash or sh) with all the required fields in the output. Support for pod ip to be present in falco version 0.35. work is in progress. https://github.com/falcosecurity/libs/pull/708 and will be called container.ip (but effectively it is the Pod_IP since all containers share the network stack of the pod) and container.cni.json for a complete view in case you have dual-stack and multiple interfaces.

- rule: shell_in_container
  desc: notice shell activity within a container
  condition: >
    container.id != host and
    evt.type = execve and
    (proc.pname = bash or
    proc.pname = sh) and
    proc.cmdline != bash

  output: >
    (user=%user.name  command=%proc.cmdline timestamp=%evt.datetime.s container_id=%container.id container_name=%container.name pod_name=%k8s.pod.name proc_name=%proc.name proc_pname=%proc.pname res=%evt.res)
  priority: informational

Upvotes: 0

xirehat
xirehat

Reputation: 1659

Your question made me go and read about falco(I learned a new lesson today). After installing falco and reading its documentation, I found a solution that seems to work.

- rule: shell_in_container
  desc: notice shell activity within a container
  condition: >
    container.id != host and
    proc.cmdline != ""

  output: >
    shell in a container
    (user=%user.name container_id=%container.id container_name=%container.name
    shell=%proc.name parent=%proc.pname source_ip=%fd.rip  cmdline=%proc.cmdline)
  priority: WARNING

Upvotes: 0

Related Questions