Write below monitored dir

Description

Trying to write to any file below a set of monitored directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Query · falco

open_write and monitored_dir and not package_mgmt_procs and not coreos_write_ssh_dir and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms and not google_accounts_daemon_writing_ssh and not cloud_init_writing_ssh and not user_known_write_monitored_dir_conditions

Rule dependencies

Depends on

  • composes · Falco macro cloud_init_writing_ssh
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro coreos_write_ssh_dir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro google_accounts_daemon_writing_ssh
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro monitored_dir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro python_running_get_pip
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro python_running_ms_oms
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_write_monitored_dir_conditions
    A shared condition, not a detection — not indexed on this site.

Analyst notes

File below a monitored directory opened for writing | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Write below monitored dir · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Write below monitored dir
desc: 'Trying to write to any file below a set of monitored directories can serve
  as an auditing rule to track general system changes. Such rules can be noisy and
  challenging to interpret, particularly if your system frequently undergoes updates.
  However, careful profiling of your environment can transform this rule into an effective
  rule for detecting unusual behavior associated with system changes, including compliance-related
  cases.

  '
condition: 'open_write and monitored_dir and not package_mgmt_procs and not coreos_write_ssh_dir
  and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms
  and not google_accounts_daemon_writing_ssh and not cloud_init_writing_ssh and not
  user_known_write_monitored_dir_conditions

  '
output: File below a monitored directory opened for writing | file=%fd.name pcmdline=%proc.pcmdline
  gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_persistence
- T1543

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.