Modify binary dirs

Description

Trying to modify any file below a set of binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Query · falco

modify and bin_dir_rename and not package_mgmt_procs and not exe_running_docker_save and not user_known_modify_bin_dir_activities

Rule dependencies

Depends on

  • composes · Falco macro bin_dir_rename
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro modify
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_modify_bin_dir_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

File below known binary directory renamed/removed | file=%fd.name pcmdline=%proc.pcmdline evt_args=%evt.args evt_type=%evt.type evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Modify binary dirs · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Modify binary dirs
desc: 'Trying to modify any file below a set of binary directories can serve as an
  auditing rule to track general system changes. Such rules can be noisy and challenging
  to interpret, particularly if your system frequently undergoes updates. However,
  careful profiling of your environment can transform this rule into an effective
  rule for detecting unusual behavior associated with system changes, including compliance-related
  cases.

  '
condition: 'modify and bin_dir_rename and not package_mgmt_procs and not exe_running_docker_save
  and not user_known_modify_bin_dir_activities

  '
output: File below known binary directory renamed/removed | file=%fd.name pcmdline=%proc.pcmdline
  evt_args=%evt.args evt_type=%evt.type evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_defense_evasion
- T1222.002

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.