Interpreted procs outbound network activity

Description

Any outbound network activity performed by any interpreted program (perl, python, ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing it effectively requires significant time and might result in a moderate level of noise. Suggesting customizing this rule to be more specific. For example, you could set it up to alert only for important namespaces after studying their usual behavior.

Query · falco

outbound and interpreted_procs

Rule dependencies

Depends on

  • composes · Falco macro interpreted_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro outbound
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Interpreted program performed outgoing network connection | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Interpreted procs outbound network activity · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Interpreted procs outbound network activity
desc: 'Any outbound network activity performed by any interpreted program (perl, python,
  ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing
  it effectively requires significant time and might result in a moderate level of
  noise. Suggesting customizing this rule to be more specific. For example, you could
  set it up to alert only for important namespaces after studying their usual behavior.

  '
condition: 'outbound and interpreted_procs

  '
enabled: false
output: Interpreted program performed outgoing network connection | connection=%fd.name
  lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_sandbox
- host
- container
- network
- mitre_exfiltration
- TA0011

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.