Packet socket created in container

rule: Packet socket created in container
desc: 'Detect new packet socket at the device driver (OSI Layer 2) level in a container.
  Packet socket could be used for ARP Spoofing and privilege escalation (CVE-2020-14386)
  by an attacker. Noise can be reduced by using the user_known_packet_socket_binaries
  template list.

  '
condition: 'evt.type=socket and container and evt.arg.domain contains AF_PACKET and
  not proc.name in (user_known_packet_socket_binaries)

  '
output: Packet socket was created in a container | socket_info=%evt.args connection=%fd.name
  lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_stable
- container
- network
- mitre_credential_access
- T1557.002