feat(rules): detect container shell spawn for MITRE T1059#363
feat(rules): detect container shell spawn for MITRE T1059#363JayKnowSo wants to merge 2 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: JayKnowSo The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @JayKnowSo! It looks like this is your first PR to falcosecurity/rules 🎉 |
|
Hey @JayKnowSo Can you sign-off your commit, please? 🙏 |
Adds detection rule for shell processes spawned inside containers by non-shell parent processes — a common indicator of container escape attempts and command injection exploitation. MITRE ATT&CK: T1059 - Command and Scripting Interpreter Tags: container, shell, mitre_execution Signed-off-by: Jemel Padilla <worklife0524@gmail.com>
- drop image= field from output (defer to append_output config) - add exe_flags=%evt.arg.flags per spawned_process style guide - anchor systemctl/service stop args with startswith and leading space - anchor iptables -F flag with startswith and leading-space patterns - drop network tag (rule fires on execve only, no socket activity) Signed-off-by: Jemel Padilla <worklife0524@gmail.com>
407a871 to
c5c64c5
Compare
|
All four addressed. |
|
CI failures appear to be GitHub Actions infrastructure issues — internal server errors on action archive downloads and a 403 on the repo access. Not related to the rule changes. Happy to re-run once the CI stabilizes. |
|
No yamllint violations in the code added by this PR. The 53 errors in Happy to open a separate chore PR to fix the line-length violations across |
Adds detection rule for shell processes spawned inside containers by non-shell parent processes — a common indicator of container escape attempts and command injection exploitation.
MITRE ATT&CK: T1059 - Command and Scripting Interpreter
Tags: container, shell, mitre_execution
What type of PR is this?
Any specific area of the project related to this PR?
Proposed rule maturity level
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer: