github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-03 01:46:38 +00:00
Code Issues Projects Releases Wiki Activity

rule(macro user_known_k8s_client_container): have more strict condition to avoid false positives

Browse Source 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
This commit is contained in:
Hiroki Suezawa 2019-12-07 03:03:40 +09:00 committed by Leo Di Donato
parent 965ead0c2a
commit bcc84c47c6
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/falco_rules.yaml
View File

@ -2646,13 +2646,15 @@
- list: k8s_client_binaries
items: [docker, kubectl, crictl]
# You can overwrite this macro to avoid false positives.
# (The default value is a condition for Kubernetes Cluster on GCP)
- macro: user_known_k8s_client_container
condition: (k8s.ns.name = "kube-system")
condition: (k8s.ns.name="kube-system" and container.image.repository=k8s.gcr.io/fluentd-gcp-scaler)
- rule: The docker client is executed in a container
desc: Detect a k8s client tool executed inside a container
condition: spawned_process and container and not user_known_k8s_client_container and proc.name in (k8s_client_binaries)
output: "Docker or kubernetes client executed in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)"
output: "Docker or kubernetes client executed in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline image=%container.image.repository:%container.image.tag)"
priority: WARNING
tags: [container, mitre_execution]