Unexpected inbound connection source

Description

Detect any inbound connection from a source outside of an allowed set of ips, networks, or domain names. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.

Query · falco

inbound and not ((fd.cip in (allowed_inbound_source_ipaddrs)) or
         (fd.cnet in (allowed_inbound_source_networks)) or
         (fd.cip.name in (allowed_inbound_source_domains)))

Rule dependencies

Depends on

  • composes · Falco macro inbound
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Disallowed inbound connection source | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Unexpected inbound connection source · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Unexpected inbound connection source
desc: 'Detect any inbound connection from a source outside of an allowed set of ips,
  networks, or domain names. This rule absolutely requires profiling your environment
  beforehand. Network-based rules are extremely crucial in any security program, as
  they can often provide the only definitive evidence. However, effectively operationalizing
  them can be challenging due to the potential for noise.

  '
condition: "inbound and not ((fd.cip in (allowed_inbound_source_ipaddrs)) or\n   \
  \      (fd.cnet in (allowed_inbound_source_networks)) or\n         (fd.cip.name\
  \ in (allowed_inbound_source_domains)))\n"
enabled: false
output: Disallowed inbound connection source | connection=%fd.name lport=%fd.lport
  rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_sandbox
- host
- container
- network
- mitre_command_and_control
- TA0011

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.