Skip to content

new(rules): detect security tool impairment in containers (T1562.001) #367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JayKnowSo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

new(rules): detect security tool impairment in containers (T1562.001) #367

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions rules/falco-incubating_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1007,6 +1007,36 @@
# when more than one event type is involved because some event will populate
# the filtercheck and others will always return <NA>. It would be better to use
# a more generic filter like `fs.path.*`
- macro: user_known_security_tool_disable_activities
condition: (never_true)

- rule: Defense Tool Disabled or Modified in Container
desc: >
Detect attempts to disable or modify security tooling inside a running container,
including flushing firewall rules via iptables or stopping security daemons such
as falco, auditd, or sysdig. Adversaries impair defenses after achieving initial
execution to operate undetected before lateral movement.
Maps to MITRE ATT&CK T1562.001 (Impair Defenses: Disable or Modify Tools).
condition: >
spawned_process and container
and (
(proc.name in (iptables, ip6tables) and
(proc.args contains "-F" or proc.args contains "--flush" or
proc.args contains "-X" or proc.args contains "--delete-chain"))
Comment on lines +1023 to +1025
Copy link
Copy Markdown
Member

@leogr leogr May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
(proc.name in (iptables, ip6tables) and
(proc.args contains "-F" or proc.args contains "--flush" or
proc.args contains "-X" or proc.args contains "--delete-chain"))
(proc.name in (iptables, ip6tables) and
(proc.args startswith "-F" or proc.args startswith "--flush" or
proc.args startswith "-X" or proc.args startswith "--delete-chain" or
proc.args contains " -F" or proc.args contains " --flush" or
proc.args contains " -X" or proc.args contains " --delete-chain"))

Same precision concern as the systemctl block. proc.args contains "-F" matches the substring -F anywhere in the args, including inside chain names or comment text. Combining startswith for first-position flags with contains " -F" (leading space) for later positions covers both placements while staying anchored to whitespace boundaries - same pattern as falco_rules.yaml:849-851 and falco-incubating_rules.yaml:1162-1165.

or
(proc.name = systemctl and proc.args contains "stop" and
(proc.args contains "falco" or proc.args contains "auditd" or
proc.args contains "sysdig" or proc.args contains "osquery"))
or
(proc.name = service and proc.args contains "stop" and
(proc.args contains "falco" or proc.args contains "auditd"))
Comment on lines +1027 to +1032
Copy link
Copy Markdown
Member

@leogr leogr May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
(proc.name = systemctl and proc.args contains "stop" and
(proc.args contains "falco" or proc.args contains "auditd" or
proc.args contains "sysdig" or proc.args contains "osquery"))
or
(proc.name = service and proc.args contains "stop" and
(proc.args contains "falco" or proc.args contains "auditd"))
(proc.name = systemctl and
(proc.args startswith "stop " or proc.args contains " stop ") and
(proc.args contains " falco" or proc.args contains " auditd" or
proc.args contains " sysdig" or proc.args contains " osquery"))
or
(proc.name = service and
(proc.args startswith "falco " or proc.args startswith "auditd ") and
(proc.args endswith " stop" or proc.args contains " stop "))

The current proc.args contains "stop" and (proc.args contains "falco" or ...) is an unanchored substring search on the full joined args. Both substrings just have to appear anywhere in the string, so the rule can fire on:

  • systemctl status mystop.service (if "falco" happens to appear elsewhere, e.g., in an env var path the args carry)
  • systemctl reload falco-helper-stopwatch.service (verb is reload, but both stop and falco substrings match)

Our convention for short-token matching is whitespace anchoring, see the netcat rule at falco_rules.yaml:849-851 (proc.args contains "-e ", etc.). The suggestion above anchors both the verb and the daemon name with leading/trailing whitespace, matching realistic usage like systemctl stop falco, systemctl --no-block stop falco, service falco stop while rejecting the substring-noise cases.

)
and not user_known_security_tool_disable_activities
output: Security tool disabled or firewall rules cleared in container | args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository
Copy link
Copy Markdown
Member

@leogr leogr May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
output: Security tool disabled or firewall rules cleared in container | args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository
output: Security tool disabled or firewall rules cleared in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

A few alignments with the style guide and our other rules:

  • Adding exe_flags=%evt.arg.flags, since the style guide recommends including it for spawned_process-only rules (https://falco.org/docs/rules/style-guide/#output)
  • Dropping args=%proc.args, since it's redundant with %proc.cmdline (which already includes the args)
  • Dropping container_id=%container.id image=%container.image.repository. No other rule in the tree includes these fields in upstream output (quick check: grep "%container.id\|%container.image" rules/*.yaml returns only this PR's line). The convention is to let Falco's append_output config (or the -pc option) add container metadata downstream, keeping rule outputs minimal.

priority:
WARNING
tags: [maturity_incubating, container, process, network, mitre_defense_evasion, T1562.001]
Copy link
Copy Markdown
Member

@leogr leogr May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
tags: [maturity_incubating, container, process, network, mitre_defense_evasion, T1562.001]
tags: [maturity_incubating, container, process, mitre_defense_evasion, T1562.001]

network here is a bit inconsistent with the rest of the repo. All ~20 rules currently carrying the network tag fire on actual network sockets/connections (evt.type=connect, packet socket creation, redirect of stdout/stdin to a network fd) or on the execution of network-traffic tools (nc, nmap, tcpdump). This rule fires on process exec + argument inspection on firewall/service-manager binaries, with no network fields in either condition or output. Dropping network keeps the tag set aligned with project usage.


- rule: Delete or rename shell history
desc: >
Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence.
Expand Down
Loading