Change thread namespace

Description

An attempt to alter the namespace of a process (often performed while creating a container) through the setns syscall. Conversely, the same syscall setns is triggered when an unauthorized attempt is made to break out from the container to the host, for example, when using commands like nsenter --target 1 and similar ones. Recommending to profile your environment and refine this rule for effective operationalization.

Query · falco

evt.type=setns and proc_name_exists and not (container.id=host and proc.name in (docker_binaries, k8s_binaries, lxd_binaries, nsenter)) and not proc.name in (sysdigcloud_binaries, sysdig, calico, oci-umount, cilium-cni, network_plugin_binaries) and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name startswith "runc" and not proc.cmdline startswith "containerd" and not proc.pname in (sysdigcloud_binaries, hyperkube, kubelet, protokube, dockerd, tini, aws) and not java_running_sdjagent and not kubelet_running_loopback and not rancher_agent and not rancher_network_manager and not calico_node and not weaveworks_scope and not user_known_change_thread_namespace_activities

Rule dependencies

Depends on

  • composes · Falco macro calico_node
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro java_running_sdjagent
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro kubelet_running_loopback
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro proc_name_exists
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rancher_agent
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rancher_network_manager
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_change_thread_namespace_activities
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro weaveworks_scope
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Namespace change (setns) by unexpected program | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Change thread namespace · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Change thread namespace
desc: 'An attempt to alter the namespace of a process (often performed while creating
  a container) through the setns syscall. Conversely, the same syscall setns is triggered
  when an unauthorized attempt is made to break out from the container to the host,
  for example, when using commands like `nsenter --target 1` and similar ones. Recommending
  to profile your environment and refine this rule for effective operationalization.

  '
condition: 'evt.type=setns and proc_name_exists and not (container.id=host and proc.name
  in (docker_binaries, k8s_binaries, lxd_binaries, nsenter)) and not proc.name in
  (sysdigcloud_binaries, sysdig, calico, oci-umount, cilium-cni, network_plugin_binaries)
  and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name
  startswith "runc" and not proc.cmdline startswith "containerd" and not proc.pname
  in (sysdigcloud_binaries, hyperkube, kubelet, protokube, dockerd, tini, aws) and
  not java_running_sdjagent and not kubelet_running_loopback and not rancher_agent
  and not rancher_network_manager and not calico_node and not weaveworks_scope and
  not user_known_change_thread_namespace_activities

  '
output: Namespace change (setns) by unexpected program | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- process
- mitre_privilege_escalation
- T1611

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.