Launch Package Management Process in Container

Description

Detect package management processes executed within containers. An excellent auditing rule to monitor general drifts in containers. Particularly useful for newer rules like "Drop and execute new binary in container" during incident response investigations. This helps identify common anti-patterns of ad-hoc debugging. Simultaneously, to maintain optimal hygiene, it's recommended to prevent container drifts and instead opt for redeploying new containers.

Query · falco

spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs and not user_known_package_manager_in_container and not pkg_mgmt_in_kube_proxy

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_ancestor_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro pkg_mgmt_in_kube_proxy
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_package_manager_in_container
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Package management process launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Launch Package Management Process in Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Launch Package Management Process in Container
desc: 'Detect package management processes executed within containers. An excellent
  auditing rule to monitor general drifts in containers. Particularly useful for newer
  rules like "Drop and execute new binary in container" during incident response investigations.
  This helps identify common anti-patterns of ad-hoc debugging. Simultaneously, to
  maintain optimal hygiene, it''s recommended to prevent container drifts and instead
  opt for redeploying new containers.

  '
condition: 'spawned_process and container and user.name != "_apt" and package_mgmt_procs
  and not package_mgmt_ancestor_procs and not user_known_package_manager_in_container
  and not pkg_mgmt_in_kube_proxy

  '
output: Package management process launched in container | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: ERROR
tags:
- maturity_incubating
- container
- process
- software_mgmt
- mitre_persistence
- T1505

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.