Falco Rules Changelog

Sysdig AWS Best Practices severity is now set to 'medium'

Sysdig GCP Best Practices severity is now set to 'medium'

DB program spawned process Rule

Change thread namespace

The docker client is executed in a container

Run shell untrusted

DB program spawned process

Change thread namespace

Suspicious Package Management Changes

Notable Filesystem Changes

Suspicious Filesystem Reads Policy

Suspicious Filesystem Changes

User Management Changes

Disallowed Network Activity

Inadvised Container Activity

Disallowed Container Activity

Suspicious Container Activity

Suspicious Lateral Movement Activity to Cloud

Notable Network Activity

Suspicious Package Management Changes

Suspicious Filesystem Reads Policy

User Management Changes

Disallowed Network Activity

Disallowed Container Activity

Inadvised Container Activity

Netcat Remote Code Execution in Container

Launch Sensitive Mount Container

Redirect STDOUT/STDIN to Network Connection in Container

Write below root

Change thread namespace

Change thread namespace

Create Privileged Pod

Modify Shell Configuration File

Write below binary dir

Launch Privileged Container

The docker client is executed in a container

ClusterRole With Wildcard Created

Create HostNetwork Pod

Service Account Created in Kube Namespace

K8s Role/Clusterrole Created

K8s Role/Clusterrole Deleted

K8s Role/Clusterrolebinding Created

Netcat Remote Code Execution in Container

Delete Bash History

ClusterRole With Write Privileges Created

Clear Log Activities

Modify binary dirs

Unexpected outbound connection destination

Unexpected UDP Traffic

GCP Create API Keys for a Project

GCP Create Bucket

GCP Delete Bucket

GCP List Buckets

GCP List Bucket Objects

GCP Put Bucket ACL

GCP Set Bucket IAM Policy

GCP Update Bucket

GCP Create Cloud Function Not Using Latest Runtime

GCP Create Cloud Function

GCP Update Cloud Function

CloudRun Create Service

CloudRun Replace Service

GCP Create a Default VPC Network

GCP Disable Subnet Flow Logs

GCP Enable Connecting to Serial Ports for a VM Instance

GCP Creation of a VM Instance with IP Forwarding Enabled

GCP Suspected Disable of OS Login in a VM Instance

GCP Enable Project-wide SSH keys for a VM InstanceGCP Shield Disabled for a VM Instance

GCP Create or Patch DNS Zone without DNSSEC

GCP Describe Instance

GCP Command Executed on Unused Region

GCP Create GCP-managed Service Account Key

GCP Create User-managed Service Account Key

GCP Invitation Sent to Non-corporate Account

GCP Operation by a Non-corporate Account

GCP Super Admin Executing Command

GCP Update, Disable or Delete SinkGCP Monitoring Alert Deleted

GCP Monitoring Alert Updated

GCP Disable Automatic Backups for a Cloud SQL Instance

GCP Disable the Requirement for All Incoming Connections to Use SSL for a Cloud SQL Instance

Launch Package Management Process in Container

Set Setuid or Setgid bit

Terminal shell in container

Run shell untrusted

Set Setuid or Setgid bit

The Non sudo setuid rule: Add macmnsvc (mcafee service host) to set of programs that are allowed to setuid.

The Launch Suspicious Network Tool in Container rule: Add another zookeeper image pattern that's allowed to run network tools.

The Clear Log Activities rule: Add another fluentd image as allowed to clear log files.

Add additional exceptions formats to aid in addressing false positives for rules:

The Read Sensitive File Untrusted rule:

The Launch Suspicious Network Tool in Container rule: Add another zookeeper image that is allowed to run nc inside a container.

Add additional exception patterns for the following rules:

Add additional Qualys binaries as exceptions for rules:

The Write below etc rule:

The Write below root rule : Add an additional cmdline writing to exec.fifo.

The DB program spawned process rule: Allow sqlplus spawn oracle.

Add additional sets of exception fields for rules:

Add five new rules for AWS Cloudtrail events.

Disable the AWS Cloudtrail rule, Logged in without Using MFA.

The Read Sensitive File Untrusted rule: Let the TaniumEndpoint agent read additional sensitive files.

The Write below root rule, docker_writing_state macro: Allow for paths that simply specify a path below an implied / or /root of current working directory.

The DB program spawned process rule: Add additional allowed Postgres backup utilities.

The Write below root rule:

The Write below rpm database rule: Allow tanium endpoint script to write to the rpm database.

The Contact K8S API Server From Container rule: Add another fluent-bit program that is allowed to contact the API Server.

The Non sudo setuid rule: Let swiagent read setuid.

The Read sensitive file untrusted rule:

The Write below root rule:

The Change thread namespace rule:

The System procs network activity rule : Add an additional exception pattern.

The User mgmt binaries: Let refresh-mcollec (tive-metadata), part of puppet, run user management binaries.

The Contact K8S API Server From Container rule: Let fluent-bit images run programs to contact the API server.

The Launch Suspicious Network Tool in Container rule: Let certain Openshift images run dig to perform DNS lookups.

The Clear Log Activities rule: Let certain Workinggrafana-related images clear log files in the container.

K8s Secret Created

K8s Secret Deleted

The Detect outbound connections to common miner pool ports rule: Add additional known miner domains.

Add additional exception fields to the following rules to aid customization:

The Change thread namespace rule: Add an additional exception for the Sysdig agent.

The Pod created in the Kube Namespace rule: Allow users starting with "system:" to create pods in the kube-system/kube-public namespaces.

The Read sensitive file untrusted rule: Allow puppet to run scripts that might read sensitive files.

The Write below root rule: Add an additional way to detect Cassandra to allow writes to /root/.cassandra.

The Change thread namespace rule: Allow Weaveworks Kured (Kubernetes Reboot Daemon) to change thread namespaces.

Add rpmdb_verify as an RPM Package Management program. This affects the following rules:

Write below etc: Add haproxy-ingress as a program that can write below /etc/haproxy.

Change thread namespace: Allow images ending with /ext-cilium-startup-script to change namespaces.

Launch Suspicious Network Tool in Container: Allow images ending with sysdig/cassandra and bitnami/zookeeper to run network tools inside containers.

Set setuid or setgid bit: Allow the images in the sysdig_commercial_images list to include applications with setuid/setgid binaries.

All Rules with the source, aws_cloudtrail: Switch from using jevt.value[/path] to aws.xxx to extract information out of aws_cloudtrail events.

A new rule, Launch Root User Container , has been added. It matches when a container is started and is configured to run as root. This works for Docker and CRI-O container runtimes, but not for Openshift 4.x, which does not make the necessary information available.

Macro spawned_process: Consider only successful executables. For example, where the return value is 0. This affects the following rules:

rule Change thread namespace: Let cilium nsenter

rule Change thread namespace: Let dynatrace setns

rule Change thread namespace: Let sysdig agent setns (the process name was changed recently)

rule Clear Log Activities: Allow fluentd to write/access log files in a container

macro exe_running_docker_save: Added support for Crio setting up containers. This affects several rules including:

rule Launch Package Management Process in Container: Let sysdig node-image-analyzer run rpm

Add a new rule, Container Run as Root User ,to the Inadvised Container Activity policy.

Add crio and multus to the user_known_change_thread_namespace_binaries list

Ensure that falco_rules_local.yaml is evaluated against all the default files.

Ensure that the logs clearly show which files are being evaluated.

Add the new rule, Linux Kernel Module Injection Detected,  to the  Notable Filesystem Changes policy.

Add the  multipath_writing_conf macro as an exception in the Write below etc rule.

Add the chage_list macro as exception in the User mgmt binaries rule

Update compliance tags.

Write below root: Similar to the rules that rely on a process name for exceptions, events will not be triggered if the process name is missing. For example, "".

Delete or rename shell history. Ignore docker programs that would prevent modifying shell history, when the path is expressed within the container filesystem (/.bash_history) and host filesystem (/var/lib/docker/overlay/.../.bash_history).

All Rules: Changes to the tags to add NIST 800-53 and SOC2 tags:

Launch Sensitive Mount Container: Change image matching to correctly identify Sysdig images as compared to names starting with "sysdig..."

Detect shell history deletion: Ignore paths below /var/lib/docker. For example, the container filesystem overlay images that are removed when a container is removed.

The Packet socket created in container rule is now enabled by default.

All Rules: Add user.loginuid as an output field. This uid is generally unchanging across sudo/su commands, and can more reliably identify users.

Launch Privileged Container: Add additional images that can run with privileged=true.

Launch Sensitive Mount Container: Fix a typo that allows docker.io/sysdig/agent-slim to perform sensitive mounts.

Read sensitive file untrusted: Allow linux-bench to read sensitive files containing user information.

Update Package Repository: Restrict checks to files below known package management directories.

Write below etc: Add exceptions related to calico within containers.

Write below root: Allow mysqlsh write to /root/.mysqlsh .

Read sensitive file untrusted: Allow google_oslogin_{control} read sensitive files.

Change thread namespace: Trigger only when the process name is known.

Create HostNetwork Pod: Allow several images related to GKE + default metrics/routing services run with hostnetwork=true.

Disallowed Kubernetes User: Add several known Kubernetes users to allowed list.

Pod Created in Kube Namespace: Allow several images related to GKE + default metrics/routing services run in kube-system/kube-public namespaces.

System ClusterRole Modified/Deleted: Allow modifications to the role system:managed-certificate-controller.

Created a new rule, EphemeralContainers Created for the Suspicious K8s Activity policy.

Replace the endswith operator when checking with an image repository.

Whitelisted sysdig/agent and sysdig/agent-slim . They are not available with the open-source Falco Rules.

Whitelisted dockerd-current and docker-current in the exe_running_docker_save macro.

Move the Write below root rule from the Suspicious Filesystem Changes policy to the Notable Filesystem Changes policy

Delete the NIST 800-190 Application Container Security Guide policy

Delete the Payment Card Industry Data Security Standard (PCI DSS) policy

Add a new macro, user_read_sensitive_file_containers for the Read sensitive file untrusted rule

Add docker.io/falcosecurity/falco to the falco_privileged_images list

Add kubernetes-admin to the allowed_k8s_users list

Disable Disallowed K8s Activity policy

Add placeholder macros for multiple rules

Fix the root_dir macro

Add snapd to the package_mgmt_binaries list

Add zmap to the network_tool_binaries list

Whitelist protokube, dockerd, tini, and aws in the change thread namespace rule

Add sysdig/agent-slim and sysdig/node-image-analyzer images to the user_trusted_containers macro

Add kube-apiserver-healthcheck to the allowed_k8s_users list

Remove unnecessary logging.

Add a new flag, --saas

calico_writing_state

user_known_metadata_access

k8s_containers

user_known_k8s_client_container

Add new rule Redirect stdout/stdin to network connection in container to policy Suspicious Container Activity

Add new rules Network Connection outside Local Subnet and Outbound or Inbound Traffic not to Authorized Server Process and Port to policy Suspicious Network Activity

Add new rules K8s Secret Created and K8s Secret Deleted to policy All K8s Object Modifications

Add rules Untrusted Node Successfully Joined the Cluster and Untrusted Node Unsuccessfully Tried to Join the Cluster to policy Suspicious K8s Activit

Add rule Full K8s Administrative Access to policy Suspicious K8s User Activity

Add rule Ingress Object without TLS Certificate Created to policy Inadvised K8s Activity

Check dsc_host in macro ms_oms_writing_conf

Add macros mcafee_writing_cma_d and avinetworks_supervisor_writing_ssh as exceptions in rule Write below etc

Add macro runc_writing_exec_fifo as exception in rule Write below root

Use "pmatch" instead of "in" operator to check known files under root directory

Update rule Change thread namespace to check exit event only

Add macro known_system_procs_network_activity_binaries for rule System procs network activity

Add PCI/NIST tags to the following rules:

Write below etc:

Write below root:

Change thread namespace

Run shell untrusted

Detect outbound connections to common miner pool ports

Remove the default Policy Launch Privileged Container.

The rule it used is also in the existing default policy Inadvised Container Activity, so there's no change in rule coverage.

New default policies Payment Card Industry Data Security Standard (PCI DSS) and NIST 800-190 Application Container Security Guide, which are disabled by default, contain rules specifically related to PCI and NIST standards.