Read environment variable from /proc files

Description

An attempt to read process environment variables from /proc files. The consequences are akin to accessing traditional sensitive files, as sensitive data, including secrets, might be stored in environment variables. Understanding your environment, such as identifying critical namespaces, and incorporating extra filtering statements to alert exclusively for those, can enhance the rule's effectiveness.

Query · falco

open_read and container and (fd.name glob /proc/*/environ) and not proc.name in (known_binaries_to_read_environment_variables_from_proc_files)

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Environment variables were retrieved from /proc files | file=%fd.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Read environment variable from /proc files · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Read environment variable from /proc files
desc: 'An attempt to read process environment variables from /proc files. The consequences
  are akin to accessing traditional sensitive files, as sensitive data, including
  secrets, might be stored in environment variables. Understanding your environment,
  such as identifying critical namespaces, and incorporating extra filtering statements
  to alert exclusively for those, can enhance the rule''s effectiveness.

  '
condition: 'open_read and container and (fd.name glob /proc/*/environ) and not proc.name
  in (known_binaries_to_read_environment_variables_from_proc_files)

  '
output: Environment variables were retrieved from /proc files | file=%fd.name gparent=%proc.aname[2]
  ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_incubating
- container
- filesystem
- process
- mitre_discovery
- T1083

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.