Terminal shell in container

Description

A shell was used as the entrypoint/exec point into a container with an attached terminal. Parent process may have legitimately already exited and be null (read container_entrypoint macro). Common when using "kubectl exec" in Kubernetes. Correlate with k8saudit exec logs if possible to find user or serviceaccount token used (fuzzy correlation by namespace and pod name). Rather than considering it a standalone rule, it may be best used as generic auditing rule while examining other triggered rules in this container/tty.

Query · falco

spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint and not user_expected_terminal_shell_in_container_conditions

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container_entrypoint
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro shell_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_expected_terminal_shell_in_container_conditions
    A shared condition, not a detection — not indexed on this site.

Analyst notes

A shell was spawned in a container with an attached terminal | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Terminal shell in container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Terminal shell in container
desc: 'A shell was used as the entrypoint/exec point into a container with an attached
  terminal. Parent process may have legitimately already exited and be null (read
  container_entrypoint macro). Common when using "kubectl exec" in Kubernetes. Correlate
  with k8saudit exec logs if possible to find user or serviceaccount token used (fuzzy
  correlation by namespace and pod name). Rather than considering it a standalone
  rule, it may be best used as generic auditing rule while examining other triggered
  rules in this container/tty.

  '
condition: 'spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint
  and not user_expected_terminal_shell_in_container_conditions

  '
output: A shell was spawned in a container with an attached terminal | evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_stable
- container
- shell
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.