Redirect STDOUT/STDIN to Network Connection in Container

Description

Detect redirection of stdout/stdin to a network connection within a container, achieved by utilizing a variant of the dup syscall (potential reverse shell or remote code execution https://github.com/swisskyrepo/PayloadsAllTheThings/). This detection is behavior-based and may generate noise in the system, and can be adjusted using the user_known_stand_streams_redirect_activities template macro. Tuning can be performed similarly to existing detections based on process lineage or container images, and/or it can be limited to interactive tty (tty != 0).

Query · falco

dup and container and evt.rawres in (0, 1, 2) and fd.type in ("ipv4", "ipv6") and not user_known_stand_streams_redirect_activities

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro dup
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_stand_streams_redirect_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Redirect stdout/stdin to network connection | gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] fd.sip=%fd.sip connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Redirect STDOUT/STDIN to Network Connection in Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Redirect STDOUT/STDIN to Network Connection in Container
desc: 'Detect redirection of stdout/stdin to a network connection within a container,
  achieved by utilizing a variant of the dup syscall (potential reverse shell or remote
  code execution https://github.com/swisskyrepo/PayloadsAllTheThings/). This detection
  is behavior-based and may generate noise in the system, and can be adjusted using
  the user_known_stand_streams_redirect_activities template macro. Tuning can be performed
  similarly to existing detections based on process lineage or container images, and/or
  it can be limited to interactive tty (tty != 0).

  '
condition: 'dup and container and evt.rawres in (0, 1, 2) and fd.type in ("ipv4",
  "ipv6") and not user_known_stand_streams_redirect_activities

  '
output: Redirect stdout/stdin to network connection | gparent=%proc.aname[2] ggparent=%proc.aname[3]
  gggparent=%proc.aname[4] fd.sip=%fd.sip connection=%fd.name lport=%fd.lport rport=%fd.rport
  fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_stable
- container
- network
- process
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.