poprhythm
2ed0565486
git-hook-tamper.yaml's condition used proc.exepath, which resolves to the script interpreter's path (e.g. /bin/busybox) for shebang scripts, not the script's own path - switched to proc.cmdline, which retains the originally invoked path. Confirmed via live-testing both ways. ssh-persistence/cloud-metadata-probe/db-spawned-process round out the post-incident hardening pass with a few more incubating-ruleset adaptations.
26 lines
1.3 KiB
YAML
26 lines
1.3 KiB
YAML
# Custom rule, adapted from falcosecurity/rules' Incubating ruleset (not
|
|
# shipped in this Falco image). This host has no cloud provider, so
|
|
# 169.254.169.254 (the AWS/GCP/Azure instance-metadata IP) has zero
|
|
# legitimate traffic ever - any outbound connection to it is a strong
|
|
# signal, either SSRF probing or a container image/script that assumes a
|
|
# cloud environment. Near-zero false-positive risk, so this stays a plain
|
|
# CRITICAL with no scoped exception - if something legitimate ever needs
|
|
# it, add a proc/container-scoped exception here rather than disabling.
|
|
|
|
- rule: Contact cloud metadata service from container
|
|
desc: >
|
|
Detects attempts to communicate with a cloud instance metadata service
|
|
(169.254.169.254) from a container. This host has no cloud provider,
|
|
so this endpoint should never see legitimate traffic - treat any hit
|
|
as SSRF probing or malware/scripts written for a cloud environment.
|
|
condition: >
|
|
outbound
|
|
and container
|
|
and fd.sip="169.254.169.254"
|
|
output: >
|
|
Outbound connection to cloud instance metadata service
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name
|
|
container=%container.name image=%container.image.repository pid=%proc.pid)
|
|
priority: CRITICAL
|
|
tags: [network, credential_access, mitre_credential_access]
|