Launch Suspicious Network Tool in Container

Description

Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. This rule complements the more specific "Netcat Remote Code Execution in Container" rule.

Query · falco

spawned_process and container and network_tool_procs and not user_known_network_tool_activities

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro network_tool_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_network_tool_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Network tool launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Launch Suspicious Network Tool in Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Launch Suspicious Network Tool in Container
desc: 'Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched
  within containers without any additional filters. This serves as a valuable general
  detection, but it''s recommended to invest engineering effort to fine-tune it and
  prevent a high volume of legitimate logs. This rule complements the more specific
  "Netcat Remote Code Execution in Container" rule.

  '
condition: 'spawned_process and container and network_tool_procs and not user_known_network_tool_activities

  '
output: Network tool launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_incubating
- container
- network
- process
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.