github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-11 02:52:54 +00:00
Code Issues Projects Releases Wiki Activity

rule(The docker client is executed in a container): modify condition to reduce false positive

Browse Source 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
This commit is contained in:
Hiroki Suezawa 2019-12-04 22:56:29 +09:00 committed by Lorenzo Fontana
parent fc58ac7356
commit 559b7e1bb1
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -2641,10 +2641,13 @@
- list: k8s_client_binaries - list: k8s_client_binaries
items: [docker, kubectl, crictl] items: [docker, kubectl, crictl]
- macro: user_known_k8s_client_container
condition: (k8s.ns.name = "kube-system")
- rule: The docker client is executed in a container - rule: The docker client is executed in a container
desc: Detect a k8s client tool executed inside a container desc: Detect a k8s client tool executed inside a container
condition: spawned_process and container and proc.name in (k8s_client_binaries) condition: spawned_process and container and not user_known_k8s_client_container and proc.name in (k8s_client_binaries)
output: "Docker or kubernetes client executed in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)" output: "Docker or kubernetes client executed in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)"
priority: WARNING priority: WARNING
tags: [container, mitre_execution] tags: [container, mitre_execution]