Launch Excessively Capable Container

Description

Identify containers that start with a powerful set of capabilities, with exceptions for recognized trusted images. Similar to the "Launch Privileged Container" rule, this functions as a robust auditing rule. Compromised highly privileged containers can lead to substantial harm. For instance, if another rule is triggered within such a container, it might raise suspicion, prompting closer scrutiny.

Query · falco

container_started and excessively_capable_container and not falco_privileged_containers and not user_privileged_containers

Rule dependencies

Depends on

  • composes · Falco macro container_started
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro excessively_capable_container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro falco_privileged_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_privileged_containers
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Excessively capable container started | cap_permitted=%thread.cap_permitted evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Launch Excessively Capable Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Launch Excessively Capable Container
desc: 'Identify containers that start with a powerful set of capabilities, with exceptions
  for recognized trusted images. Similar to the "Launch Privileged Container" rule,
  this functions as a robust auditing rule. Compromised highly privileged containers
  can lead to substantial harm. For instance, if another rule is triggered within
  such a container, it might raise suspicion, prompting closer scrutiny.

  '
condition: 'container_started and excessively_capable_container and not falco_privileged_containers
  and not user_privileged_containers

  '
output: Excessively capable container started | cap_permitted=%thread.cap_permitted
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: INFO
tags:
- maturity_incubating
- container
- cis
- mitre_execution
- T1610

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.