From f5baaa7cd575fa7ac33b8eeaeaadf24504d858bc Mon Sep 17 00:00:00 2001 From: DevNow Date: Fri, 15 May 2026 03:00:59 -0400 Subject: [PATCH 1/3] new(rules): detect security tool impairment in containers (T1562.001) Signed-off-by: DevNow --- rules/falco-incubating_rules.yaml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index 4157a782..ba892dac 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -1007,6 +1007,36 @@ # when more than one event type is involved because some event will populate # the filtercheck and others will always return . It would be better to use # a more generic filter like `fs.path.*` +- macro: user_known_security_tool_disable_activities + condition: (never_true) + +- rule: Defense Tool Disabled or Modified in Container + desc: > + Detect attempts to disable or modify security tooling inside a running container, + including flushing firewall rules via iptables or stopping security daemons such + as falco, auditd, or sysdig. Adversaries impair defenses after achieving initial + execution to operate undetected before lateral movement. + Maps to MITRE ATT&CK T1562.001 (Impair Defenses: Disable or Modify Tools). + condition: > + spawned_process and container + and ( + (proc.name in (iptables, ip6tables) and + (proc.args contains "-F" or proc.args contains "--flush" or + proc.args contains "-X" or proc.args contains "--delete-chain")) + or + (proc.name = systemctl and proc.args contains "stop" and + (proc.args contains "falco" or proc.args contains "auditd" or + proc.args contains "sysdig" or proc.args contains "osquery")) + or + (proc.name = service and proc.args contains "stop" and + (proc.args contains "falco" or proc.args contains "auditd")) + ) + and not user_known_security_tool_disable_activities + output: Security tool disabled or firewall rules cleared in container | args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository + priority: + WARNING + tags: [maturity_incubating, container, process, network, mitre_defense_evasion, T1562.001] + - rule: Delete or rename shell history desc: > Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. From cbea9a0dee411a348c0d0f8bf612033c95ce65f8 Mon Sep 17 00:00:00 2001 From: JayKnowSo Date: Thu, 4 Jun 2026 16:53:44 -0400 Subject: [PATCH 2/3] Update rules/falco-incubating_rules.yaml Co-authored-by: Leonardo Grasso Signed-off-by: JayKnowSo --- rules/falco-incubating_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index ba892dac..fee64f2c 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -1032,7 +1032,7 @@ (proc.args contains "falco" or proc.args contains "auditd")) ) and not user_known_security_tool_disable_activities - output: Security tool disabled or firewall rules cleared in container | args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository + output: Security tool disabled or firewall rules cleared in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags priority: WARNING tags: [maturity_incubating, container, process, network, mitre_defense_evasion, T1562.001] From d4be7619876f6efbbee6255cf7d1fc00cc5880c3 Mon Sep 17 00:00:00 2001 From: JayKnowSo Date: Thu, 4 Jun 2026 17:02:57 -0400 Subject: [PATCH 3/3] Update rules/falco-incubating_rules.yaml Co-authored-by: Leonardo Grasso Signed-off-by: JayKnowSo --- rules/falco-incubating_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index fee64f2c..86c22376 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -1035,7 +1035,7 @@ output: Security tool disabled or firewall rules cleared in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags priority: WARNING - tags: [maturity_incubating, container, process, network, mitre_defense_evasion, T1562.001] + tags: [maturity_incubating, container, process, mitre_defense_evasion, T1562.001] - rule: Delete or rename shell history desc: >