Write below binary dir

Description

Trying to write to any file below specific binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Query · falco

open_write and bin_dir and not package_mgmt_procs and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms and not user_known_write_below_binary_dir_activities

Rule dependencies

Depends on

  • composes · Falco macro bin_dir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro python_running_get_pip
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro python_running_ms_oms
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_write_below_binary_dir_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

File below a known binary directory opened for writing | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Write below binary dir · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Write below binary dir
desc: 'Trying to write to any file below specific binary directories can serve as
  an auditing rule to track general system changes. Such rules can be noisy and challenging
  to interpret, particularly if your system frequently undergoes updates. However,
  careful profiling of your environment can transform this rule into an effective
  rule for detecting unusual behavior associated with system changes, including compliance-related
  cases.

  '
condition: 'open_write and bin_dir and not package_mgmt_procs and not exe_running_docker_save
  and not python_running_get_pip and not python_running_ms_oms and not user_known_write_below_binary_dir_activities

  '
output: File below a known binary directory opened for writing | file=%fd.name pcmdline=%proc.pcmdline
  gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_persistence
- T1543

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.