github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-17 15:28:18 +00:00
Code Issues Projects Releases Wiki Activity

rule update: Fix condition for raw packets creation and renamed

Browse Source 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
This commit is contained in:
Hiroki Suezawa
2019-12-03 12:21:02 +09:00
committed by Leo Di Donato
parent ebec520ebc
commit 8b2d4e1fe6
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
rules/falco_rules.yaml
View File

@@ -2650,15 +2650,15 @@
# This rule is not enabled by default, as there are legitimate use # This rule is not enabled by default, as there are legitimate use
# cases for raw packet. If you want to enable it, modify the # cases for raw packet. If you want to enable it, modify the
# following macro. # following macro.
- macro: consider_raw_packet_creation - macro: consider_raw_packet_communication
condition: (never_true) condition: (never_true)
- list: raw_packet_binaries - list: user_known_raw_packet_binaries
items: [] items: []
- rule: Raw packet was created in a container - rule: Raw packet created in container
desc: Detect new raw packets in a container. raw packets could be used to do ARP Spoofing by attacker. desc: Detect new raw packets at the device driver (OSI Layer 2) level in a container. raw packets could be used to do ARP Spoofing by attacker.
condition: evt.type=socket and evt.arg[0]=AF_PACKET and container and not proc.name in (raw_packet_binaries) condition: consider_raw_packet_communication and evt.type=socket and evt.arg[0] in (AF_PACKET, PF_PACKET) and container and not proc.name in (user_known_raw_packet_binaries)
output: Raw packet was created in a container (user=%user.name command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag) output: Raw packet was created in a container (user=%user.name command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
priority: NOTICE priority: NOTICE
tags: [network, mitre_discovery] tags: [network, mitre_discovery]