Create Hardlink Over Sensitive Files

Description

Detect hardlink created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted".

Query · falco

create_hardlink and (evt.arg.oldpath in (sensitive_file_names))

Rule dependencies

Depends on

  • composes · Falco macro create_hardlink
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Hardlinks created over sensitive files | target=%evt.arg.oldpath linkpath=%evt.arg.newpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Create Hardlink Over Sensitive Files · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Create Hardlink Over Sensitive Files
desc: 'Detect hardlink created over a curated list of sensitive files or subdirectories
  under /etc/ or root directories. Can be customized as needed. Refer to further and
  equivalent guidance within the rule "Read sensitive file untrusted".

  '
condition: 'create_hardlink and (evt.arg.oldpath in (sensitive_file_names))

  '
output: Hardlinks created over sensitive files | target=%evt.arg.oldpath linkpath=%evt.arg.newpath
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- filesystem
- mitre_credential_access
- T1555

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.