Launch Privileged Container

Description

Detect the initial process initiation within a privileged container, with exemptions for known and trusted images. This rule primarily serves as an excellent auditing mechanism since highly privileged containers, when compromised, can result in significant harm. For instance, if another rule triggers within such a privileged container, it could be seen as more suspicious, prompting a closer inspection.

Query · falco

container_started and container.privileged=true and not falco_privileged_containers and not user_privileged_containers and not redhat_image

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container_started
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro falco_privileged_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro redhat_image
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_privileged_containers
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Privileged container started | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Launch Privileged Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Launch Privileged Container
desc: 'Detect the initial process initiation within a privileged container, with exemptions
  for known and trusted images. This rule primarily serves as an excellent auditing
  mechanism since highly privileged containers, when compromised, can result in significant
  harm. For instance, if another rule triggers within such a privileged container,
  it could be seen as more suspicious, prompting a closer inspection.

  '
condition: 'container_started and container.privileged=true and not falco_privileged_containers
  and not user_privileged_containers and not redhat_image

  '
output: Privileged container started | evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: INFO
tags:
- maturity_incubating
- container
- cis
- mitre_execution
- T1610
- PCI_DSS_10.2.5

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.