Встроенные правила аудита

spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs

Package management process launched in container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag exe_flags=%evt.arg.flags)

apt -h

spawned_process and container and proc.is_exe_upper_layer=true and not container.image.repository in (known_drop_and_execute_containers)

Executing binary not part of base image (user=%user.name user_loginuid=%user.loginuid user_uid=%user.uid comm=%proc.cmdline exe=%proc.exe container_id=%container.id image=%container.image.repository proc.name=%proc.name proc.sname=%proc.sname proc.pname=%proc.pname proc.aname[2]=%proc.aname[2] exe_flags=%evt.arg.flags proc.exe_ino=%proc.exe_ino proc.exe_ino.ctime=%proc.exe_ino.ctime proc.exe_ino.mtime=%proc.exe_ino.mtime proc.exe_ino.ctime_duration_proc_start=%proc.exe_ino.ctime_duration_proc_start proc.exepath=%proc.exepath proc.cwd=%proc.cwd proc.tty=%proc.tty container.start_ts=%container.start_ts proc.sid=%proc.sid proc.vpgid=%proc.vpgid evt.res=%evt.res)

echo "echo Hello, Falco!" > /tmp/test.sh
chmod +x /tmp/test.sh
/tmp/test.sh

chmod and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not kubelet_pod_volume and not image_scanner_drift and not deckhouse_controller_drift and not neuvector_container and not vault_env_injector_drift and not nginx_ingress_drift and evt.rawres>=0 and (
  (evt.arg.mode contains "S_IXUSR")
  or (evt.arg.mode contains "S_IXGRP")
  or (evt.arg.mode contains "S_IXOTH")
)

Drift detected (chmod), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type container_id=%container.id image=%container.image.repository)

echo "echo Hello, Falco!" > /tmp/test.sh
chmod +x /tmp/test.sh
/tmp/test.sh

evt.type in (open,openat,openat2,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not runc_writing_var_lib_containerd and not kubelet_pod_volume and not image_scanner_drift and not deckhouse_controller_drift and not neuvector_container and not vault_env_injector_drift and not nginx_ingress_drift and not lvm_lock_drift and evt.rawres>=0

Drift detected (open+create), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type container_id=%container.id image=%container.image.repository)

cat << 'EOF' > /tmp/drift_exec.c
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <sys/stat.h>
int main() {
    char path[] = "/tmp/zzz-exec";
    char *text = "#!/bin/sh\necho HACKED\n";
    int fd = open(path, O_RDWR | O_CREAT | O_TRUNC, 0755);
    write(fd, text, strlen(text));
    fchmod(fd, 0755);
    char *const args[] = {path, NULL};
    execv(path, args);
}
EOF
gcc /tmp/drift_exec.c -o /tmp/drift_exec
/tmp/drift_exec

container and bin_dir_rename and modify and not package_mgmt_procs and evt.rawres>=0

File below known binary directory renamed/removed (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args container_id=%container.id image=%container.image.repository)

touch /usr/bin/evilfile
mv /usr/bin/evilfile /usr/bin/eviltwin
rm /usr/bin/eviltwin

(kevt and kcreate and pod and response_successful)

K8s Pod Created (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl run testpod --image=alpine:latest -- /bin/sh -c "while true; do sleep 3600; done"
kubectl delete pod testpod --grace-period=0

(kevt and kdelete and pod and response_successful)

K8s Pod Deleted (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl run testpod --image=alpine:latest -- /bin/sh -c "while true; do sleep 3600; done"
kubectl delete pod testpod --grace-period=0

kevt and serviceaccount and kcreate and system_namespace and response_successful

Service account created in kube namespace (user=%ka.user.name serviceaccount=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl -n default create serviceaccount test-sa
kubectl -n default delete serviceaccount test-sa

kubectl -n kube-public create serviceaccount test-sa2
kubectl -n kube-public delete serviceaccount test-sa2

kubectl -n kube-system create serviceaccount test-sa3
kubectl -n kube-system delete serviceaccount test-sa3

kubectl -n d8-system create serviceaccount test-sa4
kubectl -n d8-system delete serviceaccount test-sa4

kactivity and clusterrolebinding and kcreate and ka.req.binding.role=cluster-admin

Cluster Role Binding to cluster-admin role (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource subjects=%ka.req.binding.subjects role=%ka.req.binding.role resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --serviceaccount=default:test
kubectl delete clusterrolebinding cluster-admin-binding

kevt and (role or clusterrole) and kcreate and role_with_wildcard

Created Role/ClusterRole with wildcard (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create role test-role1 --verb=create --resource=*
kubectl delete role test-role1

kubectl create role test-role2 --verb=* --resource=pod
kubectl delete role test-role2

kubectl create role test-role3 --verb=* --resource=*
kubectl delete role test-role3

kevt and (jevt.value[/verb] in (get,create,connect)) and (jevt.value[/requestURI] contains "/pods/") and (jevt.value[/requestURI] contains "/exec" or jevt.value[/requestURI] contains "/attach") and not (jevt.value[/impersonatedUser/username] exists and jevt.value[/impersonatedUser/username] in (exec_attach_allowed_users))

Attach/Exec to pod (user=%jevt.value[/user/username] pod=%jevt.value[/objectRef/name] resource=%jevt.value[/objectRef/resource] ns=%jevt.value[/objectRef/namespace] action=%jevt.value[/objectRef/subresource] container_name=%ka.uri.param[container] command=%ka.uri.param[command] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl run testpod --image=ubuntu:latest -- /bin/sh -c "while true; do sleep 3600; done"
kubectl create serviceaccount exec-user
kubectl create role exec-user-pod-exec --verb=get,list --resource=pods
kubectl create role exec-user-pod-exec-subresource --verb=create,get --resource=pods/exec,pods/attach
kubectl create rolebinding exec-user-pod-exec --role=exec-user-pod-exec --serviceaccount=default:exec-user
kubectl create rolebinding exec-user-pod-exec-subresource --role=exec-user-pod-exec-subresource --serviceaccount=default:exec-user
kubectl wait pod/testpod --for=condition=Ready --timeout=60s
kubectl exec testpod --as=system:serviceaccount:default:exec-user -- ls
kubectl delete rolebinding exec-user-pod-exec-subresource
kubectl delete rolebinding exec-user-pod-exec
kubectl delete role exec-user-pod-exec-subresource
kubectl delete role exec-user-pod-exec
kubectl delete serviceaccount exec-user
kubectl delete pod testpod --grace-period=0

kevt and pod_subresource and kmodify and ka.target.subresource in (ephemeralcontainers)

Ephemeral container is created in pod (user=%ka.user.name pod=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace ephemeral_container_name=%jevt.value[/requestObject/spec/ephemeralContainers/0/name] ephemeral_container_image=%jevt.value[/requestObject/spec/ephemeralContainers/0/image] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl run test --image=ubuntu:latest -- /bin/sh -c "while true; do sleep 3600; done" 
kubectl wait pod/test --for=condition=Ready --timeout=60s
kubectl debug test --image=alpine --target=test 
kubectl delete pod test --grace-period=0

kevt and (role or clusterrole) and kcreate and role_with_write_privs and not role_with_wildcard and not role_with_pod_exec

Created Role/ClusterRole with write privileges (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create role test-role --verb=create,delete --resource=pods
kubectl delete role test-role

kubectl create clusterrole test-role2 --verb=create,delete --resource=pods
kubectl delete clusterrole test-role2

kevt and (jevt.value[/stage]=ResponseComplete) and (jevt.value[/verb]=create) and (jevt.value[/objectRef/resource] in (roles,clusterroles) or jevt.value[/requestURI] contains "/roles" or jevt.value[/requestURI] contains "/clusterroles") and role_with_pod_exec and not (jevt.value[/requestObject/rules] contains "\"*\"" or jevt.value[/requestObject] contains "\"*\"") and not (jevt.value[/impersonatedUser/username] exists and jevt.value[/impersonatedUser/username] in (exec_attach_allowed_users))

Created Role/ClusterRole with pod exec privileges (user=%jevt.value[/user/username] role=%jevt.value[/objectRef/name] resource=%jevt.value[/objectRef/resource] rules=%jevt.value[/requestObject/rules] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create serviceaccount pod-exec-role-user
kubectl create role pod-exec-role-manager --verb=create,delete --resource=roles
kubectl create role pod-exec-role-required --verb=create --resource=pods/exec
kubectl create rolebinding pod-exec-role-manager --role=pod-exec-role-manager --serviceaccount=default:pod-exec-role-user
kubectl create rolebinding pod-exec-role-required --role=pod-exec-role-required --serviceaccount=default:pod-exec-role-user
kubectl create role test --verb=create --resource=pods/exec --as=system:serviceaccount:default:pod-exec-role-user
kubectl delete role test --as=system:serviceaccount:default:pod-exec-role-user
kubectl delete rolebinding pod-exec-role-required
kubectl delete rolebinding pod-exec-role-manager
kubectl delete role pod-exec-role-required
kubectl delete role pod-exec-role-manager
kubectl delete serviceaccount pod-exec-role-user

kubectl create serviceaccount pod-exec-clusterrole-user
kubectl create clusterrole pod-exec-clusterrole-manager --verb=create,delete --resource=clusterroles
kubectl create clusterrole pod-exec-clusterrole-required --verb=create --resource=pods/exec
kubectl create clusterrolebinding pod-exec-clusterrole-manager --clusterrole=pod-exec-clusterrole-manager --serviceaccount=default:pod-exec-clusterrole-user
kubectl create clusterrolebinding pod-exec-clusterrole-required --clusterrole=pod-exec-clusterrole-required --serviceaccount=default:pod-exec-clusterrole-user
kubectl create clusterrole test2 --verb=create --resource=pods/exec --as=system:serviceaccount:default:pod-exec-clusterrole-user
kubectl delete clusterrole test2 --as=system:serviceaccount:default:pod-exec-clusterrole-user
kubectl delete clusterrolebinding pod-exec-clusterrole-required
kubectl delete clusterrolebinding pod-exec-clusterrole-manager
kubectl delete clusterrole pod-exec-clusterrole-required
kubectl delete clusterrole pod-exec-clusterrole-manager
kubectl delete serviceaccount pod-exec-clusterrole-user

kevt and (role or clusterrole) and (kmodify or kdelete) and (ka.target.name startswith "system:") and not ka.target.name in (system:coredns, system:managed-certificate-controller)

System ClusterRole/Role modified or deleted (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource action=%ka.verb sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl -n kube-system create role system:test1 --verb=create --resource=pods
kubectl -n kube-system delete role system:test1

kubectl -n kube-system create clusterrole system:test2 --verb=create --resource=pods
kubectl -n kube-system delete clusterrole system:test2

kactivity and kcreate and serviceaccount and not system_namespace and response_successful

K8s Serviceaccount Created (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl get ns test || kubectl create ns test
kubectl -n test create serviceaccount test
kubectl -n test delete serviceaccount test

kactivity and writable_verbs and moduleconfig and response_successful

K8s ModuleConfig changed (user=%ka.user.name verb=%ka.verb moduleconfig=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl patch moduleconfig deckhouse --type=merge -p '{"spec":{"settings":{"allowExperimentalModules":false}}}'
kubectl patch moduleconfig deckhouse --type=merge -p '{"spec":{"settings":{"allowExperimentalModules":true}}}'

kactivity and kdelete and serviceaccount and response_successful

K8s Serviceaccount Deleted (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create serviceaccount deletetest
kubectl delete serviceaccount deletetest

kactivity and kcreate and (clusterrole or role) and response_successful and not role_with_wildcard and not role_with_pod_exec and not role_with_write_privs

K8s Cluster Role Created (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create role test1 --verb=create --resource=pods
kubectl delete role test1

kubectl create clusterrole test2 --verb=get --resource=pods
kubectl delete clusterrole test2

kactivity and kdelete and (clusterrole or role) and response_successful and not (ka.target.name startswith "system:")

K8s Cluster Role Deleted (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create role test1 --verb=create --resource=pods
kubectl delete role test1

kubectl create clusterrole test2 --verb=create --resource=pods
kubectl delete clusterrole test2

kactivity and kcreate and clusterrolebinding and response_successful and not ka.req.binding.role=cluster-admin

K8s Cluster Role Binding Created (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource subjects=%ka.req.binding.subjects role=%ka.req.binding.role resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create clusterrolebinding view-binding --clusterrole=view --serviceaccount=default:test
kubectl delete clusterrolebinding view-binding

kactivity and kdelete and clusterrolebinding and response_successful

K8s Cluster Role Binding Deleted (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --serviceaccount=default:test
kubectl delete clusterrolebinding cluster-admin-binding

fd.name startswith /var/lib/containerd/io.containerd.grpc.v1.cri/containers/ and open_read and not (proc.name in (allowed_proc_names) or proc.pname in (allowed_proc_names) or containerd_allowed_paths)

File below a known containerd directory opened for reading (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline proc.aname[1]=%proc.aname[1] gparent=%proc.aname[2] proc.aname[3]=%proc.aname[3] vpid=%proc.vpid container_id=%container.id image=%container.image.repository)

mkdir -p /var/lib/containerd/io.containerd.grpc.v1.cri/containers
echo "Hello Falco!" > /var/lib/containerd/io.containerd.grpc.v1.cri/containers/testfile
cat /var/lib/containerd/io.containerd.grpc.v1.cri/containers/testfile
rm /var/lib/containerd/io.containerd.grpc.v1.cri/containers/testfile

fd.directory startswith /var/lib/containerd and open_write and not (proc.name in (allowed_proc_names) or proc.pname in (allowed_proc_names) or containerd_allowed_paths)

File below a known containerd directory opened for writing (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline proc.aname[1]=%proc.aname[1] gparent=%proc.aname[2] proc.aname[3]=%proc.aname[3] vpid=%proc.vpid container_id=%container.id image=%container.image.repository)

mkdir -p /var/lib/containerd/io.containerd.grpc.v1.cri/containers
echo Hello Falco! > /var/lib/containerd/io.containerd.grpc.v1.cri/containers/testfile
cat /var/lib/containerd/io.containerd.grpc.v1.cri/containers/testfile
rm /var/lib/containerd/io.containerd.grpc.v1.cri/containers/testfile

kactivity and kcreate and pod and response_successful and system_namespace and not (ka.req.container.image contains @sha256:) and not (ka.target.namespace="d8-system" and ka.target.name startswith "deckhouse-")

Not all containers are running with the sha256 sum as a tag in a system namespace, which is a potential integrity control mechanism misconfiguration (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason image=%ka.req.pod.containers.image sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl -n d8-system run test --image=ubuntu:latest -- /bin/sh -c "while true; do sleep 3600; done"
kubectl -n d8-system delete pod test --grace-period=0

evt.type in (accept,listen) and fd.sport=22 and proc.name=sshd

Inbound SSH Connection Attempt (src_ip=%fd.cip connection=%fd.name container_id=%container.id)

rm -f ./ed25519*
ssh-keygen -t ed25519 -N '' -f ./id_ed25519 -q

kubectl apply -f -<<EOF
apiVersion: deckhouse.io/v1
kind: NodeUser
metadata:
  name: falco-test
spec:
  isSudoer: false
  nodeGroups:
  - '*'
  sshPublicKeys:
  - $(cat ./id_ed25519.pub)
  uid: 1224
EOF

kubectl wait nodeuser/falco-test --for=jsonpath='{.metadata.name}'=falco-test --timeout=300s
sleep 60
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null falco-test@$(kubectl get nodes -l node.deckhouse.io/deckhouse-ready=true -o json | jq -r '.items[0].status.addresses[] | select(.type=="ExternalIP") | .address') -i ./id_ed25519 "ls -la && sleep 30"
kubectl delete nodeuser/falco-test

spawned_process and proc.pname=sshd and not proc.name in (sshd, ssh-keygen, sshd-keygen)

Inbound SSH Connection (user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid shell=%proc.name parent=%proc.pname src_ip=%fd.cip connection=%fd.name container_id=%container.id)

rm -f ./ed25519*
ssh-keygen -t ed25519 -N '' -f ./id_ed25519 -q

kubectl apply -f -<<EOF
apiVersion: deckhouse.io/v1
kind: NodeUser
metadata:
  name: falco-test
spec:
  isSudoer: false
  nodeGroups:
  - '*'
  sshPublicKeys:
  - $(cat ./id_ed25519.pub)
  uid: 1224
EOF

kubectl wait nodeuser/falco-test --for=jsonpath='{.metadata.name}'=falco-test --timeout=300s
sleep 60
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null falco-test@$(kubectl get nodes -l node.deckhouse.io/deckhouse-ready=true -o json | jq -r '.items[0].status.addresses[] | select(.type=="ExternalIP") | .address') -i ./id_ed25519 "ls -la && sleep 30"
kubectl delete nodeuser/falco-test

ka.response.code=401 and not jevt.value[/requestURI] startswith /version and not jevt.value[/requestURI] in (/healthz, /readyz, /livez)

Unauthorized K8s API request detected
user=%jevt.value[/user/username]
agents=%jevt.value[/userAgent]
verb=%jevt.value[/verb]
uri=%jevt.value[/requestURI]
src_ip=%jevt.value[/sourceIPs]
dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0]
dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0]

curl -k https://$(kubectl -n default get svc kubernetes -o json | jq -r ".spec.clusterIP")/auth/test -H 'Authorization: Bearer TEST'

kevt and kcreate and ka.target.resource in (security_reports)

K8s Security Reports Created. The report may contain vulnerability information. Check the object in the cluster (user=%ka.user.name, verb=%ka.verb, ns=%ka.target.namespace, resource=%ka.target.resource, object=%ka.target.name sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

open_write_append and bin_dir and proc_name

Deckhouse binary %fd.name is missing a proper digital signature

kevt and jevt.value[/annotations/deckhouse.io~1signature] exists

K8s audit event with deckhouse.io/signature annotation. Indicates that unsigned objects or objects with invalid signatures were found in the etcd database. (user=%ka.user.name verb=%ka.verb resource=%ka.target.resource object=%ka.target.name signature=%jevt.value[/annotations/deckhouse.io~1signature])