Launch Sensitive Mount Container

Description

Detect the initial process launched within a container that has a mount from a sensitive host directory (e.g. /proc). Exceptions are made for known trusted images. This rule holds value for generic auditing; however, its noisiness varies based on your environment.

Query · falco

container_started and sensitive_mount and not falco_sensitive_mount_containers and not user_sensitive_mount_containers

Rule dependencies

Depends on

  • composes · Falco macro container_started
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro falco_sensitive_mount_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro sensitive_mount
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_sensitive_mount_containers
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Container with sensitive mount started | mounts=%container.mounts evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Launch Sensitive Mount Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Launch Sensitive Mount Container
desc: 'Detect the initial process launched within a container that has a mount from
  a sensitive host directory (e.g. /proc). Exceptions are made for known trusted images.
  This rule holds value for generic auditing; however, its noisiness varies based
  on your environment.

  '
condition: 'container_started and sensitive_mount and not falco_sensitive_mount_containers
  and not user_sensitive_mount_containers

  '
output: Container with sensitive mount started | mounts=%container.mounts evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: INFO
tags:
- maturity_sandbox
- container
- cis
- mitre_execution
- T1610

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.