diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 2e390cd4..6fc7740a 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -3218,3 +3218,21 @@
 # Application rules have moved to application_rules.yaml. Please look
 # there if you want to enable them by adding to
 # falco_rules.local.yaml.
+
+- list: proc_environ_file_names
+  items: [/proc/self/environ, /proc/1/environ]
+
+- macro: proc_environ_files
+  condition: >
+    fd.name in (proc_environ_file_names)
+
+- rule: Read environment variable from /proc files
+  desc: An attempt to read process environment variables from /proc files
+  condition: >
+    container and open_read and proc_environ_files
+  enabled: true
+  output: >
+    Environment variables were retrieved from /proc files (user=%user.name user_loginuid=%user.loginuid program=%proc.name
+    command=%proc.cmdline file=%fd.name parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] container_id=%container.id image=%container.image.repository)
+  priority: WARNING
+  tags: [filesystem, mitre_credential_access, mitre_discovery]