Kubernetes Client Tool Launched in Container

Description

Detect the execution of a Kubernetes client tool (like docker, kubectl, crictl) within a container, which is typically not expected behavior. Although this rule targets container workloads, monitoring the use of tools like crictl on the host over interactive access could also be valuable for broader auditing objectives.

Query · falco

spawned_process and container and not user_known_k8s_client_container_parens and proc.name in (k8s_client_binaries)

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_k8s_client_container_parens
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Kubernetes Client Tool Launched in Container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Kubernetes Client Tool Launched in Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Kubernetes Client Tool Launched in Container
desc: 'Detect the execution of a Kubernetes client tool (like docker, kubectl, crictl)
  within a container, which is typically not expected behavior. Although this rule
  targets container workloads, monitoring the use of tools like crictl on the host
  over interactive access could also be valuable for broader auditing objectives.

  '
condition: 'spawned_process and container and not user_known_k8s_client_container_parens
  and proc.name in (k8s_client_binaries)

  '
output: Kubernetes Client Tool Launched in Container | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_sandbox
- container
- mitre_execution
- T1610

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.