From a300892b6f866dc44e9bf102988db49e718d8173 Mon Sep 17 00:00:00 2001 From: Leonardo Grasso Date: Thu, 4 Jun 2020 10:33:24 +0200 Subject: [PATCH 1/3] rule(macro bin_dir_mkdir): correct condition to catch `mkdirat` case Since the dir's path is found: - in `evt.arg[1]` for `mkdir` - but in `evt.arg[2]` for `mkdirat` switch to `evt.arg.path` to catch both. That ensures `Mkdir binary dirs` works properly. Signed-off-by: Leonardo Grasso --- rules/falco_rules.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 9f21fd0dcfd..0a43b532517 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -80,10 +80,10 @@ - macro: bin_dir_mkdir condition: > - (evt.arg[1] startswith /bin/ or - evt.arg[1] startswith /sbin/ or - evt.arg[1] startswith /usr/bin/ or - evt.arg[1] startswith /usr/sbin/) + (evt.arg.path startswith /bin/ or + evt.arg.path startswith /sbin/ or + evt.arg.path startswith /usr/bin/ or + evt.arg.path startswith /usr/sbin/) - macro: bin_dir_rename condition: > From 564b9d1edbcbf2d90b4aa1b56c3f339e99d3d451 Mon Sep 17 00:00:00 2001 From: Leonardo Grasso Date: Thu, 4 Jun 2020 15:46:27 +0200 Subject: [PATCH 2/3] rule(macro bin_dir_rename): correct condition to catch all variants Since `evt.arg[1]` does not work for all syscalls, switch to: - `evt.arg.path` for `rmdir` and `unlink` (used by `remove` macro) - `evt.arg.name` for `unlinkat` (used by `remove` macro) - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro) That ensures `Modify binary dirs` works properly. Note that we cannot yet use `renameat2` (not supported by sinsp, see https://github.com/draios/sysdig/issues/1603 ) Signed-off-by: Leonardo Grasso --- rules/falco_rules.yaml | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 0a43b532517..444732b844b 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -55,6 +55,7 @@ - macro: proc_name_exists condition: (proc.name!="") +# todo(leogr): we miss "renameat2", but it's not yet supported by sinsp - macro: rename condition: evt.type in (rename, renameat) - macro: mkdir @@ -87,10 +88,22 @@ - macro: bin_dir_rename condition: > - evt.arg[1] startswith /bin/ or - evt.arg[1] startswith /sbin/ or - evt.arg[1] startswith /usr/bin/ or - evt.arg[1] startswith /usr/sbin/ + (evt.arg.path startswith /bin/ or + evt.arg.path startswith /sbin/ or + evt.arg.path startswith /usr/bin/ or + evt.arg.path startswith /usr/sbin/ or + evt.arg.name startswith /bin/ or + evt.arg.name startswith /sbin/ or + evt.arg.name startswith /usr/bin/ or + evt.arg.name startswith /usr/sbin/ or + evt.arg.oldpath startswith /bin/ or + evt.arg.oldpath startswith /sbin/ or + evt.arg.oldpath startswith /usr/bin/ or + evt.arg.oldpath startswith /usr/sbin/ or + evt.arg.newpath startswith /bin/ or + evt.arg.newpath startswith /sbin/ or + evt.arg.newpath startswith /usr/bin/ or + evt.arg.newpath startswith /usr/sbin/) - macro: etc_dir condition: fd.name startswith /etc/ @@ -1505,7 +1518,7 @@ - rule: Modify binary dirs desc: an attempt to modify any file below a set of binary directories. - condition: (bin_dir_rename) and modify and not package_mgmt_procs and not exe_running_docker_save + condition: bin_dir_rename and modify and not package_mgmt_procs and not exe_running_docker_save output: > File below known binary directory renamed/removed (user=%user.name command=%proc.cmdline pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args container_id=%container.id image=%container.image.repository) From 156521cbbe9f088d76e88792fe986ef3a2516c60 Mon Sep 17 00:00:00 2001 From: Leonardo Grasso Date: Thu, 4 Jun 2020 15:58:03 +0200 Subject: [PATCH 3/3] rule(Create files below dev): correct condition to catch `openat` Signed-off-by: Leonardo Grasso --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 444732b844b..b8f98fd994f 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2238,7 +2238,7 @@ desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev. condition: > fd.directory = /dev and - (evt.type = creat or (evt.type = open and evt.arg.flags contains O_CREAT)) + (evt.type = creat or ((evt.type = open or evt.type = openat) and evt.arg.flags contains O_CREAT)) and not proc.name in (dev_creation_binaries) and not fd.name in (allowed_dev_files) and not fd.name startswith /dev/tty