Back to Falco

Run Shell In Container

content/en/docs/reference/rules/examples/run_shell_in_container.md

latest611 B
Original Source
yaml
- macro: container
  condition: container.id != host

- macro: spawned_process
  condition: (evt.type in (execve, execveat))

- rule: run_shell_in_container
  desc: a shell was spawned by a non-shell program in a container. Container entrypoints are excluded.
  condition: container and proc.name = bash and spawned_process and proc.pname exists and not proc.pname in (bash, docker)
  output: "Shell spawned in a container other than entrypoint | user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline"
  priority: WARNING