Unexpected K8s NodePort Connection

Description

Detect attempts to utilize K8s NodePorts from a container. K8s NodePorts are accessible on the eth0 interface of each node, and they facilitate external traffic into a Kubernetes cluster. Attackers could misuse them for unauthorized access. The rule uses default port ranges, but check for custom ranges and make necessary adjustments. Also, consider tuning this rule as needed.

Query · falco

inbound_outbound and container and fd.sport >= 30000 and fd.sport <= 32767 and not nodeport_containers

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro inbound_outbound
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro nodeport_containers
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Unexpected K8s NodePort Connection | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Unexpected K8s NodePort Connection · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Unexpected K8s NodePort Connection
desc: 'Detect attempts to utilize K8s NodePorts from a container. K8s NodePorts are
  accessible on the eth0 interface of each node, and they facilitate external traffic
  into a Kubernetes cluster. Attackers could misuse them for unauthorized access.
  The rule uses default port ranges, but check for custom ranges and make necessary
  adjustments. Also, consider tuning this rule as needed.

  '
condition: 'inbound_outbound and container and fd.sport >= 30000 and fd.sport <= 32767
  and not nodeport_containers

  '
enabled: false
output: Unexpected K8s NodePort Connection | connection=%fd.name lport=%fd.lport rport=%fd.rport
  fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_sandbox
- network
- k8s
- container
- mitre_persistence
- T1205.001
- NIST_800-53_AC-6

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.