Update Package Repository

Description

This rule generically detects updates to package repositories and can be seen as an auditing measure. Recommend evaluating its relevance for your specific environment.

Query · falco

((open_write and access_repositories) or (modify and modify_repositories)) and not package_mgmt_procs and not package_mgmt_ancestor_procs and not exe_running_docker_save and not user_known_update_package_registry

Rule dependencies

Depends on

  • composes · Falco macro access_repositories
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro modify
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro modify_repositories
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_ancestor_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_update_package_registry
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Repository files get updated | newpath=%evt.arg.newpath file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Update Package Repository · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Update Package Repository
desc: 'This rule generically detects updates to package repositories and can be seen
  as an auditing measure. Recommend evaluating its relevance for your specific environment.

  '
condition: '((open_write and access_repositories) or (modify and modify_repositories))
  and not package_mgmt_procs and not package_mgmt_ancestor_procs and not exe_running_docker_save
  and not user_known_update_package_registry

  '
output: Repository files get updated | newpath=%evt.arg.newpath file=%fd.name pcmdline=%proc.pcmdline
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: NOTICE
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_execution
- T1072

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.