Read ssh information

Description

This rule identifies attempts to read files within ssh directories using programs that are not related to ssh. It's a simple and versatile detection method that works well alongside more specific rules focused on sensitive file access. You have a couple of options for using this rule effectively: you can adjust the specialized rules to cover all the important scenarios and ensure precedence in rule smatching for those, or you can analyze the combined view of ssh-related file access across various rules on your downstream computing platform. Just like with other rules, you can narrow down monitoring to specific processes, or you can limit it to interactive access only.

Query · falco

(open_read or open_directory)
 and (user_ssh_directory or fd.name startswith /root/.ssh)
 and not user_known_read_ssh_information_activities
 and not proc.name in (ssh_binaries)

Rule dependencies

Depends on

  • composes · Falco macro open_directory
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_read_ssh_information_activities
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_ssh_directory
    A shared condition, not a detection — not indexed on this site.

Analyst notes

ssh-related file/directory read by non-ssh program | file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Read ssh information · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Read ssh information
desc: 'This rule identifies attempts to read files within ssh directories using programs
  that are not related to ssh. It''s a simple and versatile detection method that
  works well alongside more specific rules focused on sensitive file access. You have
  a couple of options for using this rule effectively: you can adjust the specialized
  rules to cover all the important scenarios and ensure precedence in rule smatching
  for those, or you can analyze the combined view of ssh-related file access across
  various rules on your downstream computing platform. Just like with other rules,
  you can narrow down monitoring to specific processes, or you can limit it to interactive
  access only.

  '
condition: "(open_read or open_directory)\n and (user_ssh_directory or fd.name startswith\
  \ /root/.ssh)\n and not user_known_read_ssh_information_activities\n and not proc.name\
  \ in (ssh_binaries)\n"
output: ssh-related file/directory read by non-ssh program | file=%fd.name pcmdline=%proc.pcmdline
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: ERROR
tags:
- maturity_incubating
- host
- container
- filesystem
- mitre_collection
- T1005

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.