rule(Launch Package Management...): add sysdig nia

Example falco alert: Package management process launched in container (user=root user_loginuid=-1 command=rpm --dbpath=/analysis_scratch/de10314b-70bb-4149-802e-1c2c3d47f23c/rpmtmp/rpmdbfinal/var/lib/rpm -qa --queryformat [%{FILENAMES}|ANCHORETOK|%{FILEDIGESTS}|ANCHORETOK|%{FILEMODES:octal}|ANCHORETOK|%{FILEGROUPNAME}|ANCHORETOK|%{FILEUSERNAME}|ANCHORETOK|%{FILESIZES}|ANCHORETOK|%{=NAME}|ANCHORETOK|%{FILEFLAGS:fflags}|ANCHORETOK|%{=FILEDIGESTALGO}\n] container_id=3748cd603f28 container_name=sysdig-image-analyzer image=quay.io/sysdig/node-image-analyzer:latest) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
macro(exe_running_docker_save): handle crio also
2026-03-21 20:22:11 +00:00 · 2021-02-10 11:16:39 -08:00 · 2021-02-10 11:16:36 -08:00 · 2021-02-10 11:16:32 -08:00 · 2021-02-10 11:16:28 -08:00 · 2021-02-10 11:16:25 -08:00
1 changed files with 9 additions and 2 deletions
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -706,8 +706,9 @@
  condition: >
    proc.name = "exe"
    and (proc.cmdline contains "/var/lib/docker"
-    or proc.cmdline contains "/var/run/docker")
-    and proc.pname in (dockerd, docker, dockerd-current, docker-current)
+    or proc.cmdline contains "/var/run/docker"
+    or proc.cmdline contains "/var/lib/containers")
+    and proc.pname in (dockerd, docker, dockerd-current, docker-current, crio)

 - macro: python_running_get_pip
  condition: (proc.cmdline startswith "python get-pip.py")
@@ -1508,6 +1509,7 @@
      comps: in
      values: [sysdigcloud_binaries, sysdig, calico, oci-umount,
               cilium-cni, network_plugin_binaries,
+               oneagenthelper,
               user_known_change_thread_namespace_binaries]
    - name: container_proc_name
      fields: [container.id, proc.name]
@@ -1537,6 +1539,8 @@
        - [[rancher-bridge], "rancher/network-manager"]
        - [[calico-node], "calico/node"]
        - [[scope], "weaveworks/scope"]
+        - [[nsenter], "quay.io/cilium/startup-script"]
+        - [[java], "docker.io/sysdig/agent"]
  output: >
    Namespace change (setns) by unexpected program (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
    parent=%proc.pname %container.info container_id=%container.id image=%container.image.repository:%container.image.tag)
@@ -2417,6 +2421,8 @@
    - name: proc_name_image_suffix
      fields: [proc.name, container.image.repository]
      comps: [in, endswith]
+      values:
+        - [[rpm], quay.io/sysdig/node-image-analyzer]
  output: >
    Package management process launched in container (user=%user.name user_loginuid=%user.loginuid
    command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
@@ -2553,6 +2559,7 @@
        - ["fluent/fluentd-kubernetes-daemonset"]
        - ["openshift3/ose-logging-fluentd"]
        - ["containernetworking/azure-npm"]
+        - ["registry.redhat.io/openshift4/ose-logging-fluentd"]
  output: >
    Log files were tampered (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline file=%fd.name container_id=%container.id image=%container.image.repository)
  priority:
Author	SHA1	Message	Date
Mark Stemm	e7c7a9b12d	rule(Launch Package Management...): add sysdig nia Example falco alert: Package management process launched in container (user=root user_loginuid=-1 command=rpm --dbpath=/analysis_scratch/de10314b-70bb-4149-802e-1c2c3d47f23c/rpmtmp/rpmdbfinal/var/lib/rpm -qa --queryformat [%{FILENAMES}\|ANCHORETOK\|%{FILEDIGESTS}\|ANCHORETOK\|%{FILEMODES:octal}\|ANCHORETOK\|%{FILEGROUPNAME}\|ANCHORETOK\|%{FILEUSERNAME}\|ANCHORETOK\|%{FILESIZES}\|ANCHORETOK\|%{=NAME}\|ANCHORETOK\|%{FILEFLAGS:fflags}\|ANCHORETOK\|%{=FILEDIGESTALGO}\n] container_id=3748cd603f28 container_name=sysdig-image-analyzer image=quay.io/sysdig/node-image-analyzer:latest) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-02-10 11:16:39 -08:00
Mark Stemm	e01f96f3cf	macro(exe_running_docker_save): handle crio also Example falco alert: Rpm database opened for writing by a non-rpm program (command=exe / /var/lib/containers/storage/overlay/fe2aae4188fe3ba5c559c612197d4d63f17fa7a74c50fec2f1c7508d0140a323/diff file=/var/lib/rpm/__db.003 parent=crio pcmdline=crio --enable-metrics=true --metrics-port=9537 container_id=host image=<NA>) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-02-10 11:16:36 -08:00
Mark Stemm	a637523ac9	rule(Clear Log Activities): allow fluentd to write Example falco alert: Log files were tampered (user=root user_loginuid=-1 command=event_loop /usr/local/bin/fluentd --suppress-config-dump --no-supervisor -r /usr/local/share/gems/gems/fluent-plugin-elasticsearch-4.1.1/lib/fluent/plugin/elasticsearch_simple_sniffer.rb file=/var/log/journal_pos.json.tmp container_id=e846a8c3c53a image=registry.redhat.io/openshift4/ose-logging-fluentd) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-02-10 11:16:32 -08:00
Mark Stemm	ff78f26b93	rule(Change thread namespace): sysdig agent setns Example falco alert: Namespace change (setns) by unexpected program (user=root command=java parent=java KID CID1 image=docker.io/sysdig/agent) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-02-10 11:16:28 -08:00
Mark Stemm	5dda4ae3d7	rule(Change thread namespace): Let dynatrace setns Example falco alert: Namespace change (setns) by unexpected program (user=root user_loginuid=-1 command=oneagenthelper --oci-hook --installdirhost /opt/dynatrace/oneagent --configdirhost /var/lib/dynatrace/oneagent/agent/config --datastoragedirhost /var/lib/dynatrace/oneagent/datastorage --logdirhost /var/log/dynatrace/oneagent parent=<NA> host (id=host) container_id=host image=<NA>:<NA>) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-02-10 11:16:25 -08:00
Mark Stemm	0031f3944d	rule(Change thread namespace): let cilium nsenter Example falco alert: Namespace change (setns) by unexpected program (user=root user_loginuid=-1 command=nsenter -t 1 -m -u -i -n -p -- stat /tmp/node-init.cilium.io parent=manage-startup- KID CID1 image=quay.io/cilium/startup-script:62bfbe88c17778aad7bef9fa57ff9e2d4a9ba0d8) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-02-10 11:16:21 -08:00