Modify Container Entrypoint

Description

This rule detect an attempt to write on container entrypoint symlink (/proc/self/exe). Possible CVE-2019-5736 Container Breakout exploitation attempt. This rule has a more narrow scope.

Query · falco

open_write and container and (fd.name=/proc/self/exe or fd.name startswith /proc/self/fd/) and not docker_procs and not proc.cmdline = "runc:[1:CHILD] init"

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro docker_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Detect Potential Container Breakout Exploit (CVE-2019-5736) | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Modify Container Entrypoint · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Modify Container Entrypoint
desc: 'This rule detect an attempt to write on container entrypoint symlink (/proc/self/exe).
  Possible CVE-2019-5736 Container Breakout exploitation attempt. This rule has a
  more narrow scope.

  '
condition: 'open_write and container and (fd.name=/proc/self/exe or fd.name startswith
  /proc/self/fd/) and not docker_procs and not proc.cmdline = "runc:[1:CHILD] init"

  '
enabled: false
output: Detect Potential Container Breakout Exploit (CVE-2019-5736) | file=%fd.name
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_sandbox
- container
- filesystem
- mitre_initial_access
- T1611

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.