Write below root

Description

Trying to write to any file directly below / or /root can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases. Lastly, this rule stands out as potentially the noisiest one among rules related to "write below.

Query · falco

open_write and root_dir and proc_name_exists and not fd.name in (known_root_files) and not fd.directory pmatch (known_root_directories) and not exe_running_docker_save and not gugent_writing_guestagent_log and not dse_writing_tmp and not zap_writing_state and not airflow_writing_state and not rpm_writing_root_rpmdb and not maven_writing_groovy and not chef_writing_conf and not kubectl_writing_state and not cassandra_writing_state and not galley_writing_state and not calico_writing_state and not rancher_writing_root and not runc_writing_exec_fifo and not mysqlsh_writing_state and not known_root_conditions and not user_known_write_root_conditions and not user_known_write_below_root_activities

Rule dependencies

Depends on

  • composes · Falco macro airflow_writing_state
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro calico_writing_state
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro cassandra_writing_state
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro chef_writing_conf
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro dse_writing_tmp
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro galley_writing_state
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro gugent_writing_guestagent_log
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro known_root_conditions
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro kubectl_writing_state
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro maven_writing_groovy
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro mysqlsh_writing_state
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro proc_name_exists
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rancher_writing_root
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro root_dir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rpm_writing_root_rpmdb
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro runc_writing_exec_fifo
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_write_below_root_activities
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_write_root_conditions
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro zap_writing_state
    A shared condition, not a detection — not indexed on this site.

Analyst notes

File below / or /root opened for writing | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Write below root · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Write below root
desc: 'Trying to write to any file directly below / or /root can serve as an auditing
  rule to track general system changes. Such rules can be noisy and challenging to
  interpret, particularly if your system frequently undergoes updates. However, careful
  profiling of your environment can transform this rule into an effective rule for
  detecting unusual behavior associated with system changes, including compliance-related
  cases. Lastly, this rule stands out as potentially the noisiest one among rules
  related to "write below.

  '
condition: 'open_write and root_dir and proc_name_exists and not fd.name in (known_root_files)
  and not fd.directory pmatch (known_root_directories) and not exe_running_docker_save
  and not gugent_writing_guestagent_log and not dse_writing_tmp and not zap_writing_state
  and not airflow_writing_state and not rpm_writing_root_rpmdb and not maven_writing_groovy
  and not chef_writing_conf and not kubectl_writing_state and not cassandra_writing_state
  and not galley_writing_state and not calico_writing_state and not rancher_writing_root
  and not runc_writing_exec_fifo and not mysqlsh_writing_state and not known_root_conditions
  and not user_known_write_root_conditions and not user_known_write_below_root_activities

  '
output: File below / or /root opened for writing | file=%fd.name evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_persistence
- TA0003

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.