System procs network activity

Description

Detect any unexpected network activity performed by system binaries that typically shouldn't perform network activity, including coreutils binaries (like sleep, mkdir, who, date, and others) or user management binaries (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). This serves as a valuable baseline detection for network-related activities.

Query · falco

inbound_outbound and fd.sockfamily = ip and (system_procs or proc.name in (shell_binaries)) and not proc.name in (known_system_procs_network_activity_binaries) and not login_doing_dns_lookup and not user_expected_system_procs_network_activity_conditions

Rule dependencies

Depends on

  • composes · Falco macro inbound_outbound
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro login_doing_dns_lookup
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro system_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_expected_system_procs_network_activity_conditions
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Known system binary sent/received network traffic | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source System procs network activity · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: System procs network activity
desc: 'Detect any unexpected network activity performed by system binaries that typically
  shouldn''t perform network activity, including coreutils binaries (like sleep, mkdir,
  who, date, and others) or user management binaries (such as login, systemd, usermod,
  deluser, adduser, chpasswd, and others). This serves as a valuable baseline detection
  for network-related activities.

  '
condition: 'inbound_outbound and fd.sockfamily = ip and (system_procs or proc.name
  in (shell_binaries)) and not proc.name in (known_system_procs_network_activity_binaries)
  and not login_doing_dns_lookup and not user_expected_system_procs_network_activity_conditions

  '
output: Known system binary sent/received network traffic | connection=%fd.name lport=%fd.lport
  rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- host
- network
- process
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.