Write below rpm database

Description

Trying to write to the rpm database by any non-rpm related program can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Query · falco

open_write and fd.name startswith /var/lib/rpm and not rpm_procs and not ansible_running_python and not python_running_chef and not exe_running_docker_save and not amazon_linux_running_python_yum and not user_known_write_rpm_database_activities

Rule dependencies

Depends on

  • composes · Falco macro amazon_linux_running_python_yum
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro ansible_running_python
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro python_running_chef
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro rpm_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_write_rpm_database_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

rpm database opened for writing by a non-rpm program | file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Write below rpm database · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Write below rpm database
desc: 'Trying to write to the rpm database by any non-rpm related program can serve
  as an auditing rule to track general system changes. Such rules can be noisy and
  challenging to interpret, particularly if your system frequently undergoes updates.
  However, careful profiling of your environment can transform this rule into an effective
  rule for detecting unusual behavior associated with system changes, including compliance-related
  cases.

  '
condition: 'open_write and fd.name startswith /var/lib/rpm and not rpm_procs and not
  ansible_running_python and not python_running_chef and not exe_running_docker_save
  and not amazon_linux_running_python_yum and not user_known_write_rpm_database_activities

  '
output: rpm database opened for writing by a non-rpm program | file=%fd.name pcmdline=%proc.pcmdline
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- software_mgmt
- mitre_persistence
- T1072

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.