Read sensitive file trusted after startup

Description

An attempt to read any sensitive file (e.g. files containing user/password/authentication information) by a trusted program after startup. Trusted programs might read these files at startup to load initial state, but not afterwards. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rules for critical application credentials unique to your environment.

Query · falco

open_read and sensitive_files and server_procs and not proc_is_new and proc.name!="sshd" and not user_known_read_sensitive_files_activities

Rule dependencies

Depends on

  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro proc_is_new
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro sensitive_files
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro server_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_read_sensitive_files_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Sensitive file opened for reading by trusted program after startup | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Read sensitive file trusted after startup · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Read sensitive file trusted after startup
desc: 'An attempt to read any sensitive file (e.g. files containing user/password/authentication
  information) by a trusted program after startup. Trusted programs might read these
  files at startup to load initial state, but not afterwards. Can be customized as
  needed. In modern containerized cloud infrastructures, accessing traditional Linux
  sensitive files might be less relevant, yet it remains valuable for baseline detections.
  While we provide additional rules for SSH or cloud vendor-specific credentials,
  you can significantly enhance your security program by crafting custom rules for
  critical application credentials unique to your environment.

  '
condition: 'open_read and sensitive_files and server_procs and not proc_is_new and
  proc.name!="sshd" and not user_known_read_sensitive_files_activities

  '
output: Sensitive file opened for reading by trusted program after startup | file=%fd.name
  pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- filesystem
- mitre_credential_access
- T1555

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.