Feature request: Rules that match sequences of events and support for rules that match the type of record returned by a DNS lookup

[Speeddymon]

Motivation

I was reading https://www.bleepingcomputer.com/news/security/cracked-macos-apps-drain-wallets-using-scripts-fetched-from-dns-records/ just now and a thought occurred to me, as well as a few more while typing this out.

1. Retrieving TXT records is an effective way for an attacker to get additional code including simple scripts or full-fledged base64 encoded binaries which could be decoded, into an already compromised system of any kind (not just limited to MacOS, but also Linux servers as well as containers running in Docker or Kubernetes) without arousing much suspicion, so I want to be able to detect when there are repeated DNS lookups for any record type other than A, MX, and NS records.
2. Even without retrieving TXT records from DNS to download attack code, I don't want certain other types of DNS records like AAAA records being retrieved by my containers that only have an IPv4 stack available and so would never interact with IPv6 services, so I would want to detect when lookups of those records happen even once.

Feature

See above

Alternatives

Matching based on IP or name only, and you have to know the domains ahead of time in order to add them to a rule that notifies based on a list of domains, or you have to know all of the domains you talk to in order to add them to a rule that notifies based on NOT matching a list of domains, and the event has to be triggered by something already; it's not possible to match based on just the DNS lookup itself happening.

Additional context

I want to treat DNS as if DNS can't be trusted. A quick google didn't reveal any promising results for how to implement DNSSEC in a container context as a client, so I honestly think this isn't something that could be fixed at the container level. So in my mind, that means that DNS in a container should not be trusted period. Therefore, DNS lookups themselves need to generate an event in Falco that the rules can match. The default ruleset doesn't necessarily need to enable this new type of rule for all users right off the bat, which would allow time for testing and refinement over a few releases of anything implemented towards closing this issue.

[rashim27us]

@Andreagit97 @Speeddymon I love to work on this feature. Please assign this feature to me.