Remove Bulk Data from Disk

Description

Detect a process running to clear bulk data from disk with the intention to destroy data, possibly interrupting availability to systems. Profile your environment and use user_known_remove_data_activities to tune this rule.

Query · falco

spawned_process and clear_data_procs and not user_known_remove_data_activities

Rule dependencies

Depends on

  • composes · Falco macro clear_data_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_remove_data_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Bulk data has been removed from disk | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Remove Bulk Data from Disk · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Remove Bulk Data from Disk
desc: 'Detect a process running to clear bulk data from disk with the intention to
  destroy data, possibly interrupting availability to systems. Profile your environment
  and use user_known_remove_data_activities to tune this rule.

  '
condition: 'spawned_process and clear_data_procs and not user_known_remove_data_activities

  '
output: Bulk data has been removed from disk | file=%fd.name evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_stable
- host
- container
- process
- filesystem
- mitre_impact
- T1485

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.