Read sensitive file untrusted

Description

An attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rules for critical application credentials unique to your environment.

Query · falco

open_read and sensitive_files and proc_name_exists and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,
 cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,
 vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,
 in.proftpd, mandb, salt-call, salt-minion, postgres_mgmt_binaries,
 google_oslogin_
 )
and not cmp_cp_by_passwd and not ansible_running_python and not run_by_qualys and not run_by_chef and not run_by_google_accounts_daemon and not user_read_sensitive_file_conditions and not mandb_postinst and not perl_running_plesk and not perl_running_updmap and not veritas_driver_script and not perl_running_centrifydc and not runuser_reading_pam and not linux_bench_reading_etc_shadow and not user_known_read_sensitive_files_activities and not user_read_sensitive_file_containers

Rule dependencies

Depends on

  • composes · Falco macro ansible_running_python
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro cmp_cp_by_passwd
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro linux_bench_reading_etc_shadow
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro mandb_postinst
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro perl_running_centrifydc
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro perl_running_plesk
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro perl_running_updmap
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro proc_name_exists
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_chef
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_google_accounts_daemon
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_qualys
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro runuser_reading_pam
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro sensitive_files
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_read_sensitive_files_activities
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_read_sensitive_file_conditions
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_read_sensitive_file_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro veritas_driver_script
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Sensitive file opened for reading by non-trusted program | file=%fd.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Read sensitive file untrusted · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Read sensitive file untrusted
desc: 'An attempt to read any sensitive file (e.g. files containing user/password/authentication
  information). Exceptions are made for known trusted programs. Can be customized
  as needed. In modern containerized cloud infrastructures, accessing traditional
  Linux sensitive files might be less relevant, yet it remains valuable for baseline
  detections. While we provide additional rules for SSH or cloud vendor-specific credentials,
  you can significantly enhance your security program by crafting custom rules for
  critical application credentials unique to your environment.

  '
condition: "open_read and sensitive_files and proc_name_exists and not proc.name in\
  \ (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,\n cron_binaries,\
  \ read_sensitive_file_binaries, shell_binaries, hids_binaries,\n vpn_binaries, mail_config_binaries,\
  \ nomachine_binaries, sshkit_script_binaries,\n in.proftpd, mandb, salt-call, salt-minion,\
  \ postgres_mgmt_binaries,\n google_oslogin_\n )\nand not cmp_cp_by_passwd and not\
  \ ansible_running_python and not run_by_qualys and not run_by_chef and not run_by_google_accounts_daemon\
  \ and not user_read_sensitive_file_conditions and not mandb_postinst and not perl_running_plesk\
  \ and not perl_running_updmap and not veritas_driver_script and not perl_running_centrifydc\
  \ and not runuser_reading_pam and not linux_bench_reading_etc_shadow and not user_known_read_sensitive_files_activities\
  \ and not user_read_sensitive_file_containers\n"
output: Sensitive file opened for reading by non-trusted program | file=%fd.name gparent=%proc.aname[2]
  ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- filesystem
- mitre_credential_access
- T1555

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.