Interpreted procs inbound network activity

Description

Any inbound network activity performed by any interpreted program (perl, python, ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing it effectively requires significant time and might result in a moderate level of noise. Suggesting customizing this rule to be more specific. For example, you could set it up to alert only for important namespaces after studying their usual behavior.

Query · falco

inbound and interpreted_procs

Rule dependencies

Depends on

  • composes · Falco macro inbound
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro interpreted_procs
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Interpreted program received/listened for network traffic | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Interpreted procs inbound network activity · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Interpreted procs inbound network activity
desc: 'Any inbound network activity performed by any interpreted program (perl, python,
  ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing
  it effectively requires significant time and might result in a moderate level of
  noise. Suggesting customizing this rule to be more specific. For example, you could
  set it up to alert only for important namespaces after studying their usual behavior.

  '
condition: 'inbound and interpreted_procs

  '
enabled: false
output: Interpreted program received/listened for network traffic | connection=%fd.name
  lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_sandbox
- host
- container
- network
- mitre_exfiltration
- TA0011

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.