github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-19 17:14:26 +00:00
Code Issues Projects Releases Wiki Activity

update(rules): introducing list user_known_userfaultfd_activities to exclude processes known to use userfaultfd syscall

Browse Source 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
2021-06-17 12:08:58 +00:00
committed by poiana
parent 7f761ade4b
commit 7db4778f55
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
rules/falco_rules.yaml
View File

@@ -3059,13 +3059,17 @@
- macro: consider_userfaultfd_activities
condition: (always_true)
- list: user_known_userfaultfd_activities
items: []
- rule: Unprivileged Delegation of Page Faults Handling to a Userspace Process
desc: Detect a successful unprivileged userfaultfd syscall which might act as an attack primitive to exploit other bugs
condition: >
consider_userfaultfd_activities and evt.type = userfaultfd and
user.uid != 0 and
(evt.rawres >= 0 or evt.res != -1)
output: An userfaultfd syscall was successfully executed by an unprivileged user (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
(evt.rawres >= 0 or evt.res != -1) and
not proc.name in (user_known_userfaultfd_activities)
output: An userfaultfd syscall was successfully executed by an unprivileged user (user=%user.name user_loginuid=%user.loginuid process=%proc.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
priority: CRITICAL
tags: [syscall, mitre_defense_evasion]