github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-25 09:28:55 +00:00
Code Issues Projects Releases Wiki Activity

fix(rules/Set Setuid or Setgid bit): use chmod syscalls instead of chmod command

Browse Source 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
This commit is contained in:
Lorenzo Fontana 2019-08-13 11:12:43 +00:00 committed by Lorenzo Fontana
parent 7bc3fa165f
commit 3ea98b05dd
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
rules/falco_rules.yaml
View File

@ -72,6 +72,9 @@
- macro: create_symlink
condition: evt.type in (symlink, symlinkat) and evt.dir=<
- macro: chmod
condition: evt.type in (chmod, fchmod, fchmodat)
# File categories
- macro: bin_dir
condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)
@ -2416,10 +2419,10 @@
When the setuid or setgid bits are set for an application,
this means that the application will run with the privileges of the owning user or group respectively.
Detect setuid or setgid bits set via chmod
condition: consider_all_chmods and spawned_process and proc.name = "chmod" and (proc.args contains "+s" or proc.args contains "4777")
condition: consider_all_chmods and chmod and (evt.arg.mode contains "S_ISUID" or evt.arg.mode contains "S_ISGID")
output: >
Setuid or setgid bit is set via chmod (user=%user.name command=%proc.cmdline
container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
Setuid or setgid bit is set via chmod (fd=%evt.arg.fd filename=%evt.arg.filename mode=%evt.arg.mode user=%user.name
command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
priority:
NOTICE
tag: [process, mitre_persistence]