Program run with disallowed http proxy env

Description

Detect curl or wget usage with HTTP_PROXY environment variable. Attackers can manipulate the HTTP_PROXY variable's value to redirect application's internal HTTP requests. This could expose sensitive information like authentication keys and private data.

Query · falco

spawned_process and http_proxy_procs and proc.env icontains HTTP_PROXY and not allowed_ssh_proxy_env

Rule dependencies

Depends on

  • composes · Falco macro allowed_ssh_proxy_env
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro http_proxy_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Curl or wget run with disallowed HTTP_PROXY environment variable | env=%proc.env evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Program run with disallowed http proxy env · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Program run with disallowed http proxy env
desc: 'Detect curl or wget usage with HTTP_PROXY environment variable. Attackers can
  manipulate the HTTP_PROXY variable''s value to redirect application''s internal
  HTTP requests. This could expose sensitive information like authentication keys
  and private data.

  '
condition: 'spawned_process and http_proxy_procs and proc.env icontains HTTP_PROXY
  and not allowed_ssh_proxy_env

  '
output: Curl or wget run with disallowed HTTP_PROXY environment variable | env=%proc.env
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- users
- mitre_execution
- T1204

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.