System user interactive

Description

System (e.g. non-login) users spawning new processes. Can add custom service users (e.g. apache or mysqld). 'Interactive' is defined as new processes as descendants of an ssh session or login process. Consider further tuning by only looking at processes in a terminal / tty (proc.tty != 0). A newer field proc.is_vpgid_leader could be of help to distinguish if the process was "directly" executed, for instance, in a tty, or executed as a descendant process in the same process group, which, for example, is the case when subprocesses are spawned from a script. Consider this rule as a great template rule to monitor interactive accesses to your systems more broadly. However, such a custom rule would be unique to your environment. The rule "Terminal shell in container" that fires when using "kubectl exec" is more Kubernetes relevant, whereas this one could be more interesting for the underlying host.

Query · falco

spawned_process and system_users and interactive and not user_known_system_user_login

Rule dependencies

Depends on

  • composes · Falco macro interactive
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro system_users
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_system_user_login
    A shared condition, not a detection — not indexed on this site.

Analyst notes

System user ran an interactive command | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source System user interactive · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: System user interactive
desc: 'System (e.g. non-login) users spawning new processes. Can add custom service
  users (e.g. apache or mysqld). ''Interactive'' is defined as new processes as descendants
  of an ssh session or login process. Consider further tuning by only looking at processes
  in a terminal / tty (proc.tty != 0). A newer field proc.is_vpgid_leader could be
  of help to distinguish if the process was "directly" executed, for instance, in
  a tty, or executed as a descendant process in the same process group, which, for
  example, is the case when subprocesses are spawned from a script. Consider this
  rule as a great template rule to monitor interactive accesses to your systems more
  broadly. However, such a custom rule would be unique to your environment. The rule
  "Terminal shell in container" that fires when using "kubectl exec" is more Kubernetes
  relevant, whereas this one could be more interesting for the underlying host.

  '
condition: 'spawned_process and system_users and interactive and not user_known_system_user_login

  '
output: System user ran an interactive command | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: INFO
tags:
- maturity_stable
- host
- container
- users
- mitre_execution
- T1059
- NIST_800-53_AC-2

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.