Contact cloud metadata service from container

Description

Detects attempts to communicate with the Cloud Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.

Query · falco

outbound and container and fd.sip="169.254.169.254" and not user_known_metadata_access

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro outbound
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_metadata_access
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Outbound connection to cloud instance metadata service | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Contact cloud metadata service from container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Contact cloud metadata service from container
desc: 'Detects attempts to communicate with the Cloud Instance Metadata Service from
  a container. This detection is narrowly focused and might not apply to your environment.
  In addition, it could generate noise and require fine-tuning.

  '
condition: 'outbound and container and fd.sip="169.254.169.254" and not user_known_metadata_access

  '
enabled: true
output: Outbound connection to cloud instance metadata service | connection=%fd.name
  lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- network
- container
- mitre_discovery
- T1565

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.