From fa62ee05079506d4936033e5c5759121b4d97194 Mon Sep 17 00:00:00 2001 From: DevNow Date: Mon, 20 Apr 2026 01:16:45 -0400 Subject: [PATCH 1/2] feat(rules): detect container shell spawn for MITRE T1059 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds detection rule for shell processes spawned inside containers by non-shell parent processes — a common indicator of container escape attempts and command injection exploitation. MITRE ATT&CK: T1059 - Command and Scripting Interpreter Tags: container, shell, mitre_execution Signed-off-by: Jemel Padilla --- rules/falco_rules.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 40cb8b1d..a637ba45 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -1263,3 +1263,22 @@ output: Fileless execution via memfd_create | container_start_ts=%container.start_ts proc_cwd=%proc.cwd evt_res=%evt.res proc_sname=%proc.sname gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags priority: CRITICAL tags: [maturity_stable, host, container, process, mitre_defense_evasion, T1620] + +# MITRE ATT&CK T1059 — Container Escape via Command Execution +# Detects shell spawned inside container by non-shell parent process +- rule: Detect Shell Spawn in Container (T1059) + desc: > + A shell was spawned inside a container by a process that is not + itself a shell. This is a common indicator of container escape + attempts or command injection exploitation. + condition: > + spawned_process and container and + shell_procs and not proc.pname in (shell_binaries) and + not container.image.repository in (trusted_images) + output: > + Shell spawned in container by non-shell parent + (user=%user.name container=%container.name + image=%container.image.repository + parent=%proc.pname shell=%proc.name cmdline=%proc.cmdline) + priority: WARNING + tags: [container, shell, mitre_execution, T1059] From c5c64c58a57fe9bf03829211002bcef4981e701f Mon Sep 17 00:00:00 2001 From: DevNow Date: Mon, 25 May 2026 21:40:11 -0400 Subject: [PATCH 2/2] fix: address PR review feedback on T1059 container shell rule - drop image= field from output (defer to append_output config) - add exe_flags=%evt.arg.flags per spawned_process style guide - anchor systemctl/service stop args with startswith and leading space - anchor iptables -F flag with startswith and leading-space patterns - drop network tag (rule fires on execve only, no socket activity) Signed-off-by: Jemel Padilla --- rules/falco-incubating_rules.yaml | 34 +++++++++++++++++++++++++++++++ rules/falco_rules.yaml | 4 ++-- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index 4157a782..52160337 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -1007,6 +1007,40 @@ # when more than one event type is involved because some event will populate # the filtercheck and others will always return . It would be better to use # a more generic filter like `fs.path.*` +# This rule is focused on detecting shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. +# Note that it can also trigger when exiting a Terminal shell, such as with `kubectl +# exec`, which may introduce some noise. +- macro: user_known_security_tool_disable_activities + condition: (never_true) + +- rule: Defense Tool Disabled or Modified in Container + desc: > + Detect attempts to disable or modify security tooling inside a running container, + including flushing firewall rules via iptables or stopping security daemons such + as falco, auditd, or sysdig. Adversaries impair defenses after achieving initial + execution to operate undetected before lateral movement. + Maps to MITRE ATT&CK T1562.001 (Impair Defenses: Disable or Modify Tools). + condition: > + spawned_process and container + and ( + (proc.name in (iptables, ip6tables) and + ((proc.args startswith "-F" or proc.args contains " -F") or + proc.args contains "--flush" or + proc.args contains "-X" or proc.args contains "--delete-chain")) + or + (proc.name = systemctl and proc.args startswith "stop " and + (proc.args contains " falco" or proc.args contains " auditd" or + proc.args contains " sysdig" or proc.args contains " osquery")) + or + (proc.name = service and proc.args startswith "stop " and + (proc.args contains " falco" or proc.args contains " auditd")) + ) + and not user_known_security_tool_disable_activities + output: Security tool disabled or firewall rules cleared in container | proc=%proc.name args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository + priority: + WARNING + tags: [maturity_incubating, container, process, mitre_defense_evasion, T1562.001] + - rule: Delete or rename shell history desc: > Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index a637ba45..e09ef719 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -1278,7 +1278,7 @@ output: > Shell spawned in container by non-shell parent (user=%user.name container=%container.name - image=%container.image.repository - parent=%proc.pname shell=%proc.name cmdline=%proc.cmdline) + parent=%proc.pname shell=%proc.name cmdline=%proc.cmdline + exe_flags=%evt.arg.flags) priority: WARNING tags: [container, shell, mitre_execution, T1059]