Mkdir binary dirs

Description

Trying to create a directory below a set of binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Query · falco

mkdir and bin_dir_mkdir and not package_mgmt_procs and not user_known_mkdir_bin_dir_activities and not exe_running_docker_save

Rule dependencies

Depends on

  • composes · Falco macro bin_dir_mkdir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro mkdir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro package_mgmt_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_mkdir_bin_dir_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Directory below known binary directory created | directory=%evt.arg.path evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Mkdir binary dirs · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Mkdir binary dirs
desc: 'Trying to create a directory below a set of binary directories can serve as
  an auditing rule to track general system changes. Such rules can be noisy and challenging
  to interpret, particularly if your system frequently undergoes updates. However,
  careful profiling of your environment can transform this rule into an effective
  rule for detecting unusual behavior associated with system changes, including compliance-related
  cases.

  '
condition: 'mkdir and bin_dir_mkdir and not package_mgmt_procs and not user_known_mkdir_bin_dir_activities
  and not exe_running_docker_save

  '
output: Directory below known binary directory created | directory=%evt.arg.path evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_persistence
- T1222.002

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.