Container Drift Detected (chmod)

Description

Detect new executables created within a container as a result of chmod. While this detection can generate significant noise, chmod usage is frequently linked to dropping and executing malicious implants. The newer rule "Drop and execute new binary in container" provides more precise detection of this TTP using unambiguous kernel signals. It is recommended to use the new rule. However, this rule might be more relevant for auditing if applicable in your environment, such as when chmod is used on files within the /tmp folder.

Query · falco

chmod and container and evt.rawres>=0 and ((evt.arg.mode contains "S_IXUSR") or
     (evt.arg.mode contains "S_IXGRP") or
     (evt.arg.mode contains "S_IXOTH"))
and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities

Rule dependencies

Depends on

  • composes · Falco macro chmod
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro runc_writing_exec_fifo
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro runc_writing_var_lib_docker
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_container_drift_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Drift detected (chmod), new executable created in a container | filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Container Drift Detected (chmod) · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Container Drift Detected (chmod)
desc: 'Detect new executables created within a container as a result of chmod. While
  this detection can generate significant noise, chmod usage is frequently linked
  to dropping and executing malicious implants. The newer rule "Drop and execute new
  binary in container" provides more precise detection of this TTP using unambiguous
  kernel signals. It is recommended to use the new rule. However, this rule might
  be more relevant for auditing if applicable in your environment, such as when chmod
  is used on files within the /tmp folder.

  '
condition: "chmod and container and evt.rawres>=0 and ((evt.arg.mode contains \"S_IXUSR\"\
  ) or\n     (evt.arg.mode contains \"S_IXGRP\") or\n     (evt.arg.mode contains \"\
  S_IXOTH\"))\nand not runc_writing_exec_fifo and not runc_writing_var_lib_docker\
  \ and not user_known_container_drift_activities\n"
enabled: false
output: Drift detected (chmod), new executable created in a container | filename=%evt.arg.filename
  name=%evt.arg.name mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- container
- process
- filesystem
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.