new(rules): detect security tool impairment in containers (T1562.001)

[JayKnowSo]

Summary

Adds a detection rule for MITRE ATT&CK T1562.001 (Impair Defenses: Disable or Modify Tools) scoped to container workloads.

What this detects

• iptables/ip6tables flush or delete-chain commands inside a container
• systemctl stop targeting security daemons (falco, auditd, sysdig, osquery)
• service stop targeting falco or auditd

Why this matters

T1562 was the most prevalent defense evasion technique in malware campaigns in 2025. After achieving initial execution in a container (T1059), adversaries commonly disable runtime security tooling before lateral movement. No existing rule in stable, incubating, or sandbox tiers covers this technique for container workloads.

MITRE ATT&CK

https://attack.mitre.org/techniques/T1562/001/

False positives

Tunable via user_known_security_tool_disable_activities macro. Legitimate iptables usage in containers is rare and should be explicitly allowlisted.

Testing

Rule fires on: iptables -F, systemctl stop falco, service stop auditd executed inside a running container.

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: JayKnowSo
Once this PR has been reviewed and has the lgtm label, please assign darryk10 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• rules/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leogr]

Hey @JayKnowSo

Thanks for tackling this!

The bulk of my feedback is around substring-matching precision and a couple of output-template alignments, see inline 👇

Otherwise, SGMT.

🙏

[leogr]

Suggested change

	output: Security tool disabled or firewall rules cleared in container | args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository
	output: Security tool disabled or firewall rules cleared in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

A few alignments with the style guide and our other rules:

• Adding exe_flags=%evt.arg.flags, since the style guide recommends including it for spawned_process-only rules (https://falco.org/docs/rules/style-guide/#output)
• Dropping args=%proc.args, since it's redundant with %proc.cmdline (which already includes the args)
• Dropping container_id=%container.id image=%container.image.repository. No other rule in the tree includes these fields in upstream output (quick check: grep "%container.id\|%container.image" rules/*.yaml returns only this PR's line). The convention is to let Falco's append_output config (or the -pc option) add container metadata downstream, keeping rule outputs minimal.

[leogr]

Suggested change

	(proc.name = systemctl and proc.args contains "stop" and
	(proc.args contains "falco" or proc.args contains "auditd" or
	proc.args contains "sysdig" or proc.args contains "osquery"))
	or
	(proc.name = service and proc.args contains "stop" and
	(proc.args contains "falco" or proc.args contains "auditd"))
	(proc.name = systemctl and
	(proc.args startswith "stop " or proc.args contains " stop ") and
	(proc.args contains " falco" or proc.args contains " auditd" or
	proc.args contains " sysdig" or proc.args contains " osquery"))
	or
	(proc.name = service and
	(proc.args startswith "falco " or proc.args startswith "auditd ") and
	(proc.args endswith " stop" or proc.args contains " stop "))

The current proc.args contains "stop" and (proc.args contains "falco" or ...) is an unanchored substring search on the full joined args. Both substrings just have to appear anywhere in the string, so the rule can fire on:

• systemctl status mystop.service (if "falco" happens to appear elsewhere, e.g., in an env var path the args carry)
• systemctl reload falco-helper-stopwatch.service (verb is reload, but both stop and falco substrings match)

Our convention for short-token matching is whitespace anchoring, see the netcat rule at falco_rules.yaml:849-851 (proc.args contains "-e ", etc.). The suggestion above anchors both the verb and the daemon name with leading/trailing whitespace, matching realistic usage like systemctl stop falco, systemctl --no-block stop falco, service falco stop while rejecting the substring-noise cases.

[leogr]

Suggested change

	(proc.name in (iptables, ip6tables) and
	(proc.args contains "-F" or proc.args contains "--flush" or
	proc.args contains "-X" or proc.args contains "--delete-chain"))
	(proc.name in (iptables, ip6tables) and
	(proc.args startswith "-F" or proc.args startswith "--flush" or
	proc.args startswith "-X" or proc.args startswith "--delete-chain" or
	proc.args contains " -F" or proc.args contains " --flush" or
	proc.args contains " -X" or proc.args contains " --delete-chain"))

Same precision concern as the systemctl block. proc.args contains "-F" matches the substring -F anywhere in the args, including inside chain names or comment text. Combining startswith for first-position flags with contains " -F" (leading space) for later positions covers both placements while staying anchored to whitespace boundaries - same pattern as falco_rules.yaml:849-851 and falco-incubating_rules.yaml:1162-1165.

[leogr]

Suggested change

	tags: [maturity_incubating, container, process, network, mitre_defense_evasion, T1562.001]
	tags: [maturity_incubating, container, process, mitre_defense_evasion, T1562.001]

network here is a bit inconsistent with the rest of the repo. All ~20 rules currently carrying the network tag fire on actual network sockets/connections (evt.type=connect, packet socket creation, redirect of stdout/stdin to a network fd) or on the execution of network-traffic tools (nc, nmap, tcpdump). This rule fires on process exec + argument inspection on firewall/service-manager binaries, with no network fields in either condition or output. Dropping network keeps the tag set aligned with project usage.