feat(rules): detect container shell spawn for MITRE T1059#363
Conversation
Adds detection rule for shell processes spawned inside containers by non-shell parent processes — a common indicator of container escape attempts and command injection exploitation. MITRE ATT&CK: T1059 - Command and Scripting Interpreter Tags: container, shell, mitre_execution
|
Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits. 📝 Please follow instructions in the contributing guide to update your commits with the DCO Full details of the Developer Certificate of Origin can be found at developercertificate.org. The list of commits missing DCO signoff:
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: JayKnowSo The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @JayKnowSo! It looks like this is your first PR to falcosecurity/rules 🎉 |
|
Hey @JayKnowSo Can you sign-off your commit, please? 🙏 |
3 participants
Adds detection rule for shell processes spawned inside containers by non-shell parent processes — a common indicator of container escape attempts and command injection exploitation.
MITRE ATT&CK: T1059 - Command and Scripting Interpreter
Tags: container, shell, mitre_execution
What type of PR is this?
Any specific area of the project related to this PR?
Proposed rule maturity level
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer: