Run shell untrusted

Description

An attempt to spawn a shell below a non-shell application. The non-shell applications that are monitored are defined in the protected_shell_spawner macro, with protected_shell_spawning_binaries being the list you can easily customize. For Java parent processes, please note that Java often has a custom process name. Therefore, rely more on proc.exe to define Java applications. This rule can be noisier, as you can see in the exhaustive existing tuning. However, given it is very behavior-driven and broad, it is universally relevant to catch general Remote Code Execution (RCE). Allocate time to tune this rule for your use cases and reduce noise. Tuning suggestions include looking at the duration of the parent process (proc.ppid.duration) to define your long-running app processes. Checking for newer fields such as proc.vpgid.name and proc.vpgid.exe instead of the direct parent process being a non-shell application could make the rule more robust.

Query · falco

spawned_process and shell_procs and proc.pname exists and protected_shell_spawner and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,
                       needrestart_binaries,
                       mesos_shell_binaries,
                       erl_child_setup, exechealthz,
                       PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,
                       lb-controller, nvidia-installe, runsv, statsite, erlexec, calico-node,
                       "puma reactor")
and not proc.cmdline in (known_shell_spawn_cmdlines) and not proc.aname in (unicorn_launche) and not consul_running_net_scripts and not consul_running_alert_checks and not nginx_starting_nginx and not nginx_running_aws_s3_cp and not run_by_package_mgmt_binaries and not serf_script and not check_process_status and not run_by_foreman and not python_mesos_marathon_scripting and not splunk_running_forwarder and not postgres_running_wal_e and not postgres_running_cnpg and not redis_running_prepost_scripts and not rabbitmq_running_scripts and not rabbitmqctl_running_scripts and not run_by_appdynamics and not user_shell_container_exclusions

Rule dependencies

Depends on

  • composes · Falco macro check_process_status
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro consul_running_alert_checks
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro consul_running_net_scripts
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro nginx_running_aws_s3_cp
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro nginx_starting_nginx
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro postgres_running_cnpg
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro postgres_running_wal_e
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro protected_shell_spawner
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro python_mesos_marathon_scripting
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rabbitmqctl_running_scripts
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rabbitmq_running_scripts
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro redis_running_prepost_scripts
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_appdynamics
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_foreman
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_package_mgmt_binaries
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro serf_script
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro shell_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro splunk_running_forwarder
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_shell_container_exclusions
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Shell spawned by untrusted binary | parent_exe=%proc.pexe parent_exepath=%proc.pexepath pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Run shell untrusted · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Run shell untrusted
desc: 'An attempt to spawn a shell below a non-shell application. The non-shell applications
  that are monitored are defined in the protected_shell_spawner macro, with protected_shell_spawning_binaries
  being the list you can easily customize. For Java parent processes, please note
  that Java often has a custom process name. Therefore, rely more on proc.exe to define
  Java applications. This rule can be noisier, as you can see in the exhaustive existing
  tuning. However, given it is very behavior-driven and broad, it is universally relevant
  to catch general Remote Code Execution (RCE). Allocate time to tune this rule for
  your use cases and reduce noise. Tuning suggestions include looking at the duration
  of the parent process (proc.ppid.duration) to define your long-running app processes.
  Checking for newer fields such as proc.vpgid.name and proc.vpgid.exe instead of
  the direct parent process being a non-shell application could make the rule more
  robust.

  '
condition: "spawned_process and shell_procs and proc.pname exists and protected_shell_spawner\
  \ and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,\n\
  \                       needrestart_binaries,\n                       mesos_shell_binaries,\n\
  \                       erl_child_setup, exechealthz,\n                       PM2,\
  \ PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,\n                  \
  \     lb-controller, nvidia-installe, runsv, statsite, erlexec, calico-node,\n \
  \                      \"puma reactor\")\nand not proc.cmdline in (known_shell_spawn_cmdlines)\
  \ and not proc.aname in (unicorn_launche) and not consul_running_net_scripts and\
  \ not consul_running_alert_checks and not nginx_starting_nginx and not nginx_running_aws_s3_cp\
  \ and not run_by_package_mgmt_binaries and not serf_script and not check_process_status\
  \ and not run_by_foreman and not python_mesos_marathon_scripting and not splunk_running_forwarder\
  \ and not postgres_running_wal_e and not postgres_running_cnpg and not redis_running_prepost_scripts\
  \ and not rabbitmq_running_scripts and not rabbitmqctl_running_scripts and not run_by_appdynamics\
  \ and not user_shell_container_exclusions\n"
output: Shell spawned by untrusted binary | parent_exe=%proc.pexe parent_exepath=%proc.pexepath
  pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] aname[4]=%proc.aname[4]
  aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7] evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_stable
- host
- container
- process
- shell
- mitre_execution
- T1059.004

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.