Launch Disallowed Container

Description

Detect the initial process launched within a container that is not in a list of allowed containers. This rule holds value for generic auditing; however, this rule requires a good understanding of your setup and consistent effort to keep the list of allowed containers current. In some situations, this can be challenging to manage.

Query · falco

container_started and not allowed_containers

Rule dependencies

Depends on

  • composes · Falco macro allowed_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container_started
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Launch Disallowed Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Launch Disallowed Container
desc: 'Detect the initial process launched within a container that is not in a list
  of allowed containers. This rule holds value for generic auditing; however, this
  rule requires a good understanding of your setup and consistent effort to keep the
  list of allowed containers current. In some situations, this can be challenging
  to manage.

  '
condition: 'container_started and not allowed_containers

  '
output: Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_sandbox
- container
- mitre_lateral_movement
- T1610

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.