Exfiltrating Artifacts via Kubernetes Control Plane

Description

Detect the copying of artifacts from a container's file system using the Kubernetes control plane (kubectl cp). This rule can identify potential exfiltration of application secrets from containers' file systems, potentially revealing the outcomes of unauthorized access and control plane misuse via stolen identities (such as stolen credentials like Kubernetes serviceaccount tokens). Can be customized by the adopter to only monitor specific artifact paths, containers, or namespaces as needed.

Query · falco

open_read and container and proc.name=tar and container_entrypoint and proc.tty=0 and not system_level_side_effect_artifacts_kubectl_cp

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container_entrypoint
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_read
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro system_level_side_effect_artifacts_kubectl_cp
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Exfiltrating Artifacts via Kubernetes Control Plane | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Exfiltrating Artifacts via Kubernetes Control Plane · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Exfiltrating Artifacts via Kubernetes Control Plane
desc: 'Detect the copying of artifacts from a container''s file system using the Kubernetes
  control plane (kubectl cp). This rule can identify potential exfiltration of application
  secrets from containers'' file systems, potentially revealing the outcomes of unauthorized
  access and control plane misuse via stolen identities (such as stolen credentials
  like Kubernetes serviceaccount tokens). Can be customized by the adopter to only
  monitor specific artifact paths, containers, or namespaces as needed.

  '
condition: 'open_read and container and proc.name=tar and container_entrypoint and
  proc.tty=0 and not system_level_side_effect_artifacts_kubectl_cp

  '
output: Exfiltrating Artifacts via Kubernetes Control Plane | file=%fd.name evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- container
- filesystem
- mitre_exfiltration
- TA0010

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.