Feature/lab9

labs/lab9/falco/rules/custom-rules.yaml

@@ -0,0 +1,39 @@
+- rule: Container Write Activity in /tmp
+  desc: Identify processes that create or modify files under /tmp within a container
+  condition: open_write and container.id != host and fd.name startswith /tmp/
+  output: Container process wrote to /tmp (container=%container.name user=%user.name file=%fd.name command=%proc.cmdline)
+  priority: WARNING
+  tags: [container, drift]
+
+- list: recognized_mining_processes
+  items: [xmrig, ethminer, cgminer, t-rex, claymore]
+
+- rule: Suspected Cryptocurrency Mining Behavior
+  desc: Identify container activity involving typical mining-pool ports or recognized cryptocurrency-mining processes
+  condition: >
+    container.id != host
+    and
+    (
+      (
+        evt.type=connect
+        and
+        (
+          fd.sport in (3333, 4444, 5555, 7777, 14444, 19999, 45700)
+          or evt.args endswith ":3333"
+          or evt.args endswith ":4444"
+          or evt.args endswith ":5555"
+          or evt.args endswith ":7777"
+          or evt.args endswith ":14444"
+          or evt.args endswith ":19999"
+          or evt.args endswith ":45700"
+        )
+      )
+      or
+      (
+        evt.type in (execve, execveat)
+        and proc.name in (recognized_mining_processes)
+      )
+    )
+  output: Suspected cryptocurrency-mining behavior detected (container=%container.name process=%proc.name command=%proc.cmdline target=%evt.args connection=%fd.name)
+  priority: CRITICAL
+  tags: [container, mitre_execution, mitre_command_and_control]

labs/lab9/policies/extra/hardening.rego

@@ -0,0 +1,83 @@
+package main
+
+pod_enforces_non_root if {
+  input.spec.template.spec.securityContext.runAsNonRoot == true
+}
+
+container_enforces_non_root(container) if {
+  container.securityContext.runAsNonRoot == true
+}
+
+removes_all_capabilities(container) if {
+  security_context := object.get(container, "securityContext", {})
+  capabilities := object.get(security_context, "capabilities", {})
+  dropped_capabilities := object.get(capabilities, "drop", [])
+
+  "ALL" in dropped_capabilities
+}
+
+# 1. Ensure non-root execution is configured at either the pod or container level.
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.containers[_]
+
+  not pod_enforces_non_root
+  not container_enforces_non_root(container)
+
+  msg := sprintf(
+    "container %q must enable runAsNonRoot at the pod or container level",
+    [container.name],
+  )
+}
+
+# 2. Disallow processes from acquiring extra privileges.
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.containers[_]
+
+  not container.securityContext.allowPrivilegeEscalation == false
+
+  msg := sprintf(
+    "container %q must disable privilege escalation",
+    [container.name],
+  )
+}
+
+# 3. Ensure every Linux capability is removed.
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.containers[_]
+
+  not removes_all_capabilities(container)
+
+  msg := sprintf(
+    "container %q must remove all Linux capabilities",
+    [container.name],
+  )
+}
+
+# 4. Ensure a memory limit is defined for each container.
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.containers[_]
+
+  not container.resources.limits.memory
+
+  msg := sprintf(
+    "container %q must define a memory resource limit",
+    [container.name],
+  )
+}
+
+# 5. Ensure container images are locked to an immutable SHA-256 digest.
+deny contains msg if {
+  input.kind == "Deployment"
+  container := input.spec.template.spec.containers[_]
+
+  not contains(container.image, "@sha256:")
+
+  msg := sprintf(
+    "container %q must reference an image pinned to an @sha256 digest",
+    [container.name],
+  )
+}