Skip to content

Instantly share code, notes, and snippets.

@johnfitzpatrick

johnfitzpatrick/falco_Blacklisted_Containers.yaml

Created October 7, 2019 13:31
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save johnfitzpatrick/73030028db0fb3f423a97af3ba407422 to your computer and use it in GitHub Desktop.
Save johnfitzpatrick/73030028db0fb3f423a97af3ba407422 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
falco_Blacklisted_Containers.yaml
- rule: Blacklisted Containers
desc: >
Detect the initial process started by a container that is from a list of blacklisted containers.
condition: container_started and container and blacklisted_containers
output: Container started is blacklisted (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
priority: WARNING
tags: [container, mitre_lateral_movement]
- macro: blacklisted_containers
condition: (container.name startswith 'k8s_actor_actor')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment