Read Shell Configuration File

Description

This rule detects attempts made by non-shell programs to read shell configuration files. It offers additional generic auditing. It serves as a baseline detection alert for unusual shell configuration file accesses. The rule "Modify Shell Configuration File" might be more relevant and adequate for your specific cases.

Query · falco

open_read and (fd.filename in (shell_config_filenames) or
     fd.name in (shell_config_files) or
     fd.directory in (shell_config_directories))
and not proc.name in (shell_binaries)

Rule dependencies

Depends on

  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.

Analyst notes

A shell configuration file was read by a non-shell program | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Read Shell Configuration File · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Read Shell Configuration File
desc: 'This rule detects attempts made by non-shell programs to read shell configuration
  files. It offers additional generic auditing. It serves as a baseline detection
  alert for unusual shell configuration file accesses. The rule "Modify Shell Configuration
  File" might be more relevant and adequate for your specific cases.

  '
condition: "open_read and (fd.filename in (shell_config_filenames) or\n     fd.name\
  \ in (shell_config_files) or\n     fd.directory in (shell_config_directories))\n\
  and not proc.name in (shell_binaries)\n"
enabled: false
output: A shell configuration file was read by a non-shell program | file=%fd.name
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_discovery
- T1546.004

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.