Container Drift Detected (open+create)

Description

Detect new executables created within a container as a result of open+create. The newer rule "Drop and execute new binary in container" provides more precise detection of this TTP using unambiguous kernel signals. It is recommended to use the new rule.

Query · falco

evt.type in (open,openat,openat2,creat) and evt.rawres>=0 and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro runc_writing_exec_fifo
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro runc_writing_var_lib_docker
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_container_drift_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Drift detected (open+create), new executable created in a container | filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Container Drift Detected (open+create) · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Container Drift Detected (open+create)
desc: 'Detect new executables created within a container as a result of open+create.
  The newer rule "Drop and execute new binary in container" provides more precise
  detection of this TTP using unambiguous kernel signals. It is recommended to use
  the new rule.

  '
condition: 'evt.type in (open,openat,openat2,creat) and evt.rawres>=0 and evt.is_open_exec=true
  and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker
  and not user_known_container_drift_activities

  '
enabled: false
output: Drift detected (open+create), new executable created in a container | filename=%evt.arg.filename
  name=%evt.arg.name mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- container
- process
- filesystem
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.