Directory traversal monitored file read

Description

Web applications can be vulnerable to directory traversal attacks that allow accessing files outside of the web app's root directory (e.g. Arbitrary File Read bugs). System directories like /etc are typically accessed via absolute paths. Access patterns outside of this (here path traversal) can be regarded as suspicious. This rule includes failed file open attempts.

Query · falco

(open_read or open_file_failed) and (etc_dir or user_ssh_directory or
     fd.name startswith /root/.ssh or
     fd.name contains "id_rsa")
and directory_traversal and not proc.pname in (shell_binaries)

Rule dependencies

Depends on

  • composes · Falco macro directory_traversal
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro etc_dir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_file_failed
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_ssh_directory
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Read monitored file via directory traversal | file=%fd.name fileraw=%fd.nameraw gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Directory traversal monitored file read · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Directory traversal monitored file read
desc: 'Web applications can be vulnerable to directory traversal attacks that allow
  accessing files outside of the web app''s root directory (e.g. Arbitrary File Read
  bugs). System directories like /etc are typically accessed via absolute paths. Access
  patterns outside of this (here path traversal) can be regarded as suspicious. This
  rule includes failed file open attempts.

  '
condition: "(open_read or open_file_failed) and (etc_dir or user_ssh_directory or\n\
  \     fd.name startswith /root/.ssh or\n     fd.name contains \"id_rsa\")\nand directory_traversal\
  \ and not proc.pname in (shell_binaries)\n"
enabled: true
output: Read monitored file via directory traversal | file=%fd.name fileraw=%fd.nameraw
  gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- filesystem
- mitre_credential_access
- T1555

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.