Безопасность Kubernetes с Falco и обнаружение вторжений

rule: Read sensitive file in container
  desc: Detect reading of sensitive files
  condition: >
    container and openat_read and
    (fd.name startswith /etc/shadow or
     fd.name startswith /etc/passwd)
  output: >
    Sensitive file opened for reading (user=%user.name container=%container.name
    file=%fd.name)
  priority: WARNING
  tags: [process, mitre_credential_access]

falco:
  jsonOutput: true
  timeFormatISO8601: true
  programOutput:
    enabled: true
  falcosidekick:
    enabled: true
    config:
      slack:
        webhookurl: "https://hooks.slack.com/services/XXXX/YYYY/ZZZZ"

customRules:
  rules-dangerous-commands.yaml: |-
    - rule: Execute high-risk command
      desc: A high risk command execution was detected
      condition: >
        spawned_process and container and
        (proc.name in (nc, ncat, netcat, nmap, dig, tcpdump, tshark, iptables) or
         proc.name = "curl" and proc.args contains "-o")
      output: >
        High risk command executed in container (user=%user.name command=%proc.cmdline
        container=%container.name image=%container.image.repository:%container.image.tag)
      priority: WARNING
      tags: [process, danger, mitre_execution]

falcosidekick:
  enabled: true
  config:
    slack:
      webhookurl: "https://hooks.slack.com/services/XXXX/YYYY/ZZZZ"
      outputformat: "all"
      minimumpriority: "warning"

falcosidekick:
  enabled: true
  config:
    elasticsearch:
      hostport: "http://elasticsearch:9200"
      index: "falco"
      type: "event"

falco:
  webserver:
    enabled: true
    k8sAuditEndpoint: /k8s-audit
    serviceMonitor:
      enabled: true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: falco-responder
spec:
  replicas: 1
  selector:
    matchLabels:
      app: falco-responder
  template:
    metadata:
      labels:
        app: falco-responder
    spec:
      containers:
      - name: responder
        image: myrepo/falco-responder:latest
        args:
        - "--listen=/responder/events.sock"
        volumeMounts:
        - mountPath: /responder
          name: responder-socket
      volumes:
      - name: responder-socket
        emptyDir: {}

rule: Unexpected payment API access
  desc: Detected access to payment API from unauthorized container
  condition: >
    evt.type = "connect" and evt.dir = ">" and
    (fd.sip = "payment-gateway.example.com" or fd.sip = "192.168.1.42") and
    not container.image.repository contains "payment-processor"
  output: >
    Unauthorized payment API access detected (user=%user.name container=%container.name
    destination=%fd.sip:%fd.sport)
  priority: CRITICAL
  tags: [network, payment, pci-dss]

rule: PHI Data Access
  desc: Detected unusual access to patient health information
  condition: >
    spawned_process and container and
    proc.cmdline contains "/data/patient" and
    not container.image.repository in (authorized-phi-containers)
  output: >
    Unauthorized PHI data access (user=%user.name command=%proc.cmdline
    container=%container.name)
  priority: CRITICAL
  tags: [process, hipaa, data-leak]

list: authorized_images
  items: [
    'registry.example.com/app/frontend',
    'registry.example.com/app/backend',
    'registry.example.com/app/database',
    'docker.io/nginx:1.19'
  ]
 
rule: Unauthorized Container Image
  desc: Detect launching of unauthorized container images
  condition: >
    container and not container.image.repository in (authorized_images)
  output: >
    Unauthorized container image detected (image=%container.image.repository:%container.image.tag)
  priority: WARNING
  tags: [container, compliance]

falcosidekick:
  config:
    slack:
      webhookurl: "https://hooks.slack.com/services/XXX/YYY"
      minimumpriority: "medium"
    pagerduty:
      routingkey: "xxxx"
      minimumpriority: "high"
    jira:
      apiurl: "https://jira.example.com"
      username: "falco"
      password: "xxxx"
      minimumpriority: "medium"
    aws:
      lambda:
        functionname: "isolate-pod"
        minimumpriority: "critical"

apiVersion: v1
kind: Pod
metadata:
  name: high-performance-app
  annotations:
    falco/skip-rules: "shell_in_container,write_below_etc"
spec:
  containers:
  - name: app
    image: myapp:latest

falco:
  k8sAuditRules:
    enabled: true
  webserver:
    enabled: true
    k8sAuditEndpoint: /k8s-audit
  extraVolumes:
    - name: k8s-audit
      hostPath:
        path: /var/log/kube-apiserver-audit.log

rule: Container Privilege Escalation
desc: Detect attempts to escalate privileges inside container
condition: >
  container and
  (evt.type=setuid or evt.type=setgid) and
  (evt.dir=< and evt.arg.uid=0) and
  not proc.name in (authorized_priv_change_binaries)
output: >
  Privilege escalation attempt in container (user=%user.name command=%proc.cmdline
  parent=%proc.pname container=%container.name image=%container.image.repository)
priority: CRITICAL
tags: [container, privilege_escalation, mitre_privilege_escalation]

rule: Unusual Network Connection to Pod
desc: Detect unusual network connections between pods
condition: >
  inbound and 
  container and
  fd.sport in (sensitive_ports) and
  not (source_container.image.repository in (allowed_source_images))
output: >
  Unusual network connection to sensitive port (source ip=%fd.cip source container=%source_container.name
  target container=%container.name port=%fd.sport)
priority: WARNING
tags: [network, lateral_movement, mitre_lateral_movement]

rule: Unusual Outbound Traffic from Container
desc: Detect unusual outbound connections from containers
condition: >
  outbound and container and
  not (fd.sip in (allowed_destination_ips)) and
  not (fd.domain in (allowed_domains)) and
  not container.image.repository in (unrestricted_net_images)
output: >
  Unexpected outbound connection (container=%container.name
  image=%container.image.repository connection=%fd.name destination=%fd.sip:%fd.sport)
priority: WARNING
tags: [network, exfiltration, mitre_exfiltration]

rule: PCI DSS Credit Card Data Access
desc: Detect unauthorized access to credit card data
condition: >
  spawned_process and container and 
  (proc.cmdline contains "credit" and proc.cmdline contains "card") and
  not container.image.repository in (payment_processing_images)
output: >
  Potential credit card data access (user=%user.name container=%container.name
  command=%proc.cmdline)
priority: CRITICAL
tags: [pci-dss, data_access, mitre_collection]

rule: Crypto Miner Detected
desc: Detect crypto mining activity inside container
condition: >
  spawned_process and container and
  ((proc.name in (crypto_miner_processes) or
    proc.cmdline contains "pool-proxy" or
    proc.cmdline contains "stratum+tcp"))
output: >
  Potential crypto mining activity (user=%user.name command=%proc.cmdline
  container=%container.name image=%container.image.repository)
priority: CRITICAL
tags: [container, cryptojacking, mitre_resource_hijacking]

rule: Kubernetes Secrets Access
desc: Detect attempts to access Kubernetes secrets
condition: >
  evt.type=open and
  fd.name startswith /run/secrets/kubernetes.io and
  container and
  not container.image.repository in (system_images)
output: >
  K8s secrets accessed from container (user=%user.name command=%proc.cmdline
  secret=%fd.name container=%container.name image=%container.image.repository)
priority: WARNING
tags: [container, k8s, secrets, mitre_credential_access]

rule: Container Escape Detection
  desc: Detect potential container escape techniques
  condition: >
    container and
    ((evt.type=setns and evt.arg.flags contains "CLONE_NEWPID") or
     (proc.name=mount and proc.args contains "/proc/sys") or
     (evt.type=container and 
      (container.privileged=true or container.sensitive_mount="true")))
  output: >
    Potential container escape attempt (user=%user.name command=%proc.cmdline
    container=%container.name parent=%proc.pname privileges=%container.privileged)
  priority: CRITICAL
  tags: [container, escape, mitre_privilege_escalation]

rule: Binary Modified in Container
  desc: Detect modification of binary files in container
  condition: >
    container and evt.type=open and evt.arg.flags contains "O_WRONLY" and
    fd.name pmatch "/usr/bin/*" and not proc.name in (package_management_procs)
  output: >
    Binary file modified in container (user=%user.name container=%container.name
    command=%proc.cmdline file=%fd.name parent=%proc.pname)
  priority: WARNING
  tags: [container, filesystem, mitre_persistence]

rule: Terminal Shell in Container
  desc: A shell was spawned in a container with an attached terminal
  condition: >
    container and
    proc.name in (shell_binaries) and
    evt.type=execve and
    proc.tty!=0 and
    container.image.repository != "alpine-debug"
  output: >
    Interactive shell detected (user=%user.name container=%container.name
    image=%container.image.repository shell=%proc.name parent=%proc.pname)
  priority: WARNING
  tags: [container, shell, mitre_execution]

rule: Package Management Detected
  desc: Detect package management usage in container
  condition: >
    container and spawned_process and
    proc.name in (package_mgmt_binaries) and
    not container.image.repository in (package_mgmt_allowed)
  output: >
    Package management utility used in container (user=%user.name
    command=%proc.cmdline container=%container.name)
  priority: WARNING
  tags: [container, software_management, mitre_persistence]

macro: sensitive_files
  items: [
    /etc/shadow,
    /etc/passwd,
    /etc/kubernetes/admin.conf,
    /var/run/secrets/kubernetes.io/serviceaccount/token
  ]
 
rule: Sensitive File Opened
  desc: Detect access to sensitive files
  condition: >
    open_read and container and fd.name in (sensitive_files) and
    not proc.name in (allowed_sensitive_files_procs) and
    not proc.cmdline startswith "kube-apiserver" and
    not proc.pname in (authn_processes)
  output: >
    Sensitive file opened for reading (user=%user.name command=%proc.cmdline
    file=%fd.name container=%container.name)
  priority: WARNING
  tags: [container, filesystem, mitre_credential_access]

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress