The module lifecycle stage: Generally available version

The module has requirements for installation

Summary

Rule set Rule Description Priority Source Tags
Fstec Launch Package Management Process in container Detects execution of package management processes (apt/yum/dnf/apk, etc.) inside a container. Often indicates container drift, runtime tool installation, or post-compromise activity. Error Syscall fstec, container_drift
Fstec Drop and execute new binary in container Detects execution of a binary in a container that is not part of the base image (OverlayFS upper-layer executable). Typical “drop and execute” behavior after gaining a foothold in a container. Critical Syscall fstec, container_drift
Fstec Container drift detected (chmod) Detects chmod operations inside a container that result in an executable (execute bits) being created/enabled. May indicate container drift or preparation of a malicious tool for execution. Error Syscall fstec, container_drift
Fstec Container drift detected (open+create) Detects creation of an executable file inside a container via open/create followed by execution. Common in container drift scenarios or when downloading and running malicious binaries. Error Syscall fstec, container_drift
Fstec Modify binary dirs Detects rename/remove operations under standard binary directories (/bin, /sbin, /usr/bin, /usr/sbin) inside a container. May indicate system utility tampering or attempts to hide traces. Error Syscall fstec, container_drift
Fstec K8s Pod created Detects successful Kubernetes Pod creation from audit logs. Useful for tracking new workloads and investigating unexpected launches. Informational K8sAudit fstec, container_drift
Fstec K8s Pod deleted Detects successful Kubernetes Pod deletion from audit logs. Useful for spotting sabotage, cover-up attempts, and incident analysis. Informational K8sAudit fstec, container_drift
Fstec ServiceAccount created in a system namespace Detects ServiceAccount creation in system namespaces (kube-system, kube-public, default or d8-*). Can indicate an attempt to establish persistence and gain additional privileges. Warning K8sAudit fstec, rbac_drift
Fstec Attach to cluster-admin Role Detects creation of a ClusterRoleBinding that grants the cluster-admin role. This is a critical action providing full administrative access to the cluster. Warning K8sAudit fstec, rbac_drift
Fstec ClusterRole with wildcard created Detects creation of a Role/ClusterRole with wildcard resources or verbs ("*") in RBAC rules. Such roles greatly expand privileges and often indicate misconfiguration or privilege escalation. Warning K8sAudit fstec, rbac_drift
Fstec Attach/Exec Pod Detects attempts to exec/attach to a Pod (exec/attach subresources) from audit logs. May indicate interactive container access and manual runtime actions. Notice K8sAudit fstec, container_image_access
Fstec EphemeralContainers created Detects adding ephemeral containers to a Pod. Ephemeral containers are often used for debugging but can also be abused for stealthy access. Notice K8sAudit fstec, container_image_access
Fstec ClusterRole with write privileges created Detects creation of a Role/ClusterRole with write privileges (create, update, patch, delete). Such roles can modify cluster objects and may be used for escalation or unauthorized changes. Notice K8sAudit fstec, rbac_drift
Fstec ClusterRole with Pod Exec created Detects creation of a Role/ClusterRole granting access to pods with exec. Exec access allows running commands in containers and often implies high control over workloads. Warning K8sAudit fstec, rbac_drift
Fstec System ClusterRole modified/deleted Detects modification or deletion of system Role/ClusterRole objects (system:*), with some allowed exceptions. May indicate an attempt to disrupt cluster operation or weaken security. Warning K8sAudit fstec, rbac_drift
Fstec K8s ServiceAccount created Detects ServiceAccount creation outside system namespaces. Can be normal for apps but is also used to prepare access and later grant RBAC privileges. Notice K8sAudit fstec, rbac_drift
Fstec K8s ModuleConfig modified Detects modifications to ModuleConfig objects from audit logs. ModuleConfig changes can affect component behavior and security settings and should be monitored. Notice K8sAudit fstec, rbac_drift
Fstec K8s ServiceAccount deleted Detects ServiceAccount deletion from audit logs. May indicate access artifact cleanup or changes in application/service configuration. Notice K8sAudit fstec, rbac_drift
Fstec K8s Role/ClusterRole created Detects Role/ClusterRole creation from audit logs. Used to monitor RBAC changes and spot unexpected privilege expansion. Notice K8sAudit fstec, rbac_drift
Fstec K8s Role/ClusterRole deleted Detects Role/ClusterRole deletion from audit logs. May indicate cover-up attempts, rollback of access configuration, or disruptive changes. Notice K8sAudit fstec, rbac_drift
Fstec K8s ClusterRoleBinding created Detects ClusterRoleBinding creation from audit logs. ClusterRoleBindings change cluster-wide permission assignments and can be a privilege escalation vector. Notice K8sAudit fstec, rbac_drift
Fstec K8s ClusterRoleBinding deleted Detects ClusterRoleBinding deletion from audit logs. May cause loss of access or be used to hide unauthorized bindings. Notice K8sAudit fstec, rbac_drift
Fstec Read below containerd images dir Detects reading files under containerd directories related to CRI container data. May indicate attempts to extract container/image information or unusual runtime data access. Notice Syscall fstec, container_image_access
Fstec Write below containerd images dir Detects writes/modifications under containerd directories. May indicate runtime data tampering, drift, or supply-chain related attacks targeting container data. Error Syscall fstec, container_image_drift
Fstec Container tag is not @sha256 Detects Pod creation in a system namespace using an image not pinned by digest (@sha256:). Using mutable tags weakens integrity controls and increases the risk of image substitution. Notice K8sAudit fstec, integrity_control
Fstec Inbound SSH Connection Attempt Detects inbound SSH connection attempts to port 22 on the host, including failed authentication. The username is not available at this stage. To capture usernames for failed authentication attempts, configure security events based on sshd logs. Notice Syscall fstec, auth_attempts
Fstec Inbound SSH Connection Detects successful inbound SSH connections to port 22 on the host. Triggers when sshd spawns a login shell after successful authentication. The username is resolved via the k8s-nodeuser-info plugin (nodeusers.deckhouse.io) by login UID; this only works for Deckhouse NodeUser accounts. For other users, only the numeric UID is available — configure security events based on sshd logs to capture usernames for non-NodeUser accounts. Notice Syscall fstec, auth_attempts
Fstec Unauthorized request to Kubernetes API Detects Kubernetes API requests resulting in HTTP 401 (Unauthorized) in audit logs (excluding common health and version endpoints). May indicate token guessing, misconfigured clients, or attacker activity. Warning K8sAudit fstec, auth_attempts
Fstec Security Reports Created Detects creation of security report resources (configauditreports/vulnerabilityreports). May indicate a scan run, new vulnerability findings, or security-related container activity. Notice K8sAudit fstec, security_reports
D8IntegrityCheck Missing digital signature One of the binary files used by Deckhouse system components has failed the signature verification. Check the logs of the d8-bcheck utility and contact technical support. Error Syscall integrity_check, subscription_check
D8IntegrityCheck Event with deckhouse.io/signature annotation A Kubernetes API event with the deckhouse.io/signature annotation was detected. Indicates that unsigned objects or objects with invalid signatures were found in the etcd database. Notice K8sAudit integrity_check, signature

Rule sets

Fstec

Launch Package Management Process in container

Detects execution of package management processes (apt/yum/dnf/apk, etc.) inside a container. Often indicates container drift, runtime tool installation, or post-compromise activity.

  • Priority: Error
  • Source: Syscall
  • Tags: fstec, container_drift

Condition

spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs

Output

Package management process launched in container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag exe_flags=%evt.arg.flags)

How to test

  • Environment: container

Commands:

apt -h

Drop and execute new binary in container

Detects execution of a binary in a container that is not part of the base image (OverlayFS upper-layer executable). Typical “drop and execute” behavior after gaining a foothold in a container.

  • Priority: Critical
  • Source: Syscall
  • Tags: fstec, container_drift

Condition

spawned_process and container and proc.is_exe_upper_layer=true and not container.image.repository in (known_drop_and_execute_containers)

Output

Executing binary not part of base image (user=%user.name user_loginuid=%user.loginuid user_uid=%user.uid comm=%proc.cmdline exe=%proc.exe container_id=%container.id image=%container.image.repository proc.name=%proc.name proc.sname=%proc.sname proc.pname=%proc.pname proc.aname[2]=%proc.aname[2] exe_flags=%evt.arg.flags proc.exe_ino=%proc.exe_ino proc.exe_ino.ctime=%proc.exe_ino.ctime proc.exe_ino.mtime=%proc.exe_ino.mtime proc.exe_ino.ctime_duration_proc_start=%proc.exe_ino.ctime_duration_proc_start proc.exepath=%proc.exepath proc.cwd=%proc.cwd proc.tty=%proc.tty container.start_ts=%container.start_ts proc.sid=%proc.sid proc.vpgid=%proc.vpgid evt.res=%evt.res)

How to test

  • Environment: container

Commands:

cp /bin/echo /tmp/falco-drop-exec
/tmp/falco-drop-exec Hello, Falco!

Container drift detected (chmod)

Detects chmod operations inside a container that result in an executable (execute bits) being created/enabled. May indicate container drift or preparation of a malicious tool for execution.

  • Priority: Error
  • Source: Syscall
  • Tags: fstec, container_drift

Condition

chmod and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not kubelet_pod_volume and not image_scanner_drift and not deckhouse_controller_drift and not neuvector_container and not vault_env_injector_drift and not nginx_ingress_drift and evt.rawres>=0 and (
  (evt.arg.mode contains "S_IXUSR")
  or (evt.arg.mode contains "S_IXGRP")
  or (evt.arg.mode contains "S_IXOTH")
)

Output

Drift detected (chmod), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type container_id=%container.id image=%container.image.repository)

How to test

  • Environment: container

Commands:

echo "echo Hello, Falco!" > /tmp/falco-chmod.sh
chmod +x /tmp/falco-chmod.sh
/tmp/falco-chmod.sh

Container drift detected (open+create)

Detects creation of an executable file inside a container via open/create followed by execution. Common in container drift scenarios or when downloading and running malicious binaries.

  • Priority: Error
  • Source: Syscall
  • Tags: fstec, container_drift

Condition

evt.type in (open,openat,openat2,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not runc_writing_var_lib_containerd and not kubelet_pod_volume and not image_scanner_drift and not deckhouse_controller_drift and not neuvector_container and not vault_env_injector_drift and not nginx_ingress_drift and not lvm_lock_drift and evt.rawres>=0

Output

Drift detected (open+create), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type container_id=%container.id image=%container.image.repository)

How to test

  • Environment: container

Commands:

# The file is created anew: an open of an existing file creates no executable.
rm -f /tmp/falco-drift-exec
cat << 'EOF' > /tmp/falco-drift.c
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <sys/stat.h>
int main() {
    char path[] = "/tmp/falco-drift-exec";
    char *text = "#!/bin/sh\necho HACKED\n";
    int fd = open(path, O_RDWR | O_CREAT | O_TRUNC, 0755);
    write(fd, text, strlen(text));
    fchmod(fd, 0755);
    char *const args[] = {path, NULL};
    execv(path, args);
}
EOF
gcc /tmp/falco-drift.c -o /tmp/falco-drift
/tmp/falco-drift

Modify binary dirs

Detects rename/remove operations under standard binary directories (/bin, /sbin, /usr/bin, /usr/sbin) inside a container. May indicate system utility tampering or attempts to hide traces.

  • Priority: Error
  • Source: Syscall
  • Tags: fstec, container_drift

Condition

container and bin_dir_rename and modify and not package_mgmt_procs and evt.rawres>=0

Output

File below known binary directory renamed/removed (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args container_id=%container.id image=%container.image.repository)

How to test

  • Environment: container

Commands:

touch /usr/bin/falco-evil
mv /usr/bin/falco-evil /usr/bin/falco-eviltwin
rm -f /usr/bin/falco-eviltwin

K8s Pod created

Detects successful Kubernetes Pod creation from audit logs. Useful for tracking new workloads and investigating unexpected launches.

  • Priority: Informational
  • Source: K8sAudit
  • Tags: fstec, container_drift

Condition

(kevt and kcreate and pod and response_successful)

Output

K8s Pod Created (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete pod falco-pod-created --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl run falco-pod-created --image=mirror.gcr.io/library/alpine:3.22 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl delete pod falco-pod-created --grace-period=0

K8s Pod deleted

Detects successful Kubernetes Pod deletion from audit logs. Useful for spotting sabotage, cover-up attempts, and incident analysis.

  • Priority: Informational
  • Source: K8sAudit
  • Tags: fstec, container_drift

Condition

(kevt and kdelete and pod and response_successful)

Output

K8s Pod Deleted (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete pod falco-pod-deleted --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl run falco-pod-deleted --image=mirror.gcr.io/library/alpine:3.22 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl delete pod falco-pod-deleted --grace-period=0

ServiceAccount created in a system namespace

Detects ServiceAccount creation in system namespaces (kube-system, kube-public, default or d8-*). Can indicate an attempt to establish persistence and gain additional privileges.

  • Priority: Warning
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kevt and serviceaccount and kcreate and system_namespace and response_successful

Output

Service account created in kube namespace (user=%ka.user.name serviceaccount=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl -n default delete serviceaccount falco-system-sa-1 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n default create serviceaccount falco-system-sa-1
kubectl -n default delete serviceaccount falco-system-sa-1
trap 'kubectl -n kube-public delete serviceaccount falco-system-sa-2 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n kube-public create serviceaccount falco-system-sa-2
kubectl -n kube-public delete serviceaccount falco-system-sa-2
trap 'kubectl -n kube-system delete serviceaccount falco-system-sa-3 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n kube-system create serviceaccount falco-system-sa-3
kubectl -n kube-system delete serviceaccount falco-system-sa-3
trap 'kubectl -n d8-system delete serviceaccount falco-system-sa-4 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n d8-system create serviceaccount falco-system-sa-4
kubectl -n d8-system delete serviceaccount falco-system-sa-4

Attach to cluster-admin Role

Detects creation of a ClusterRoleBinding that grants the cluster-admin role. This is a critical action providing full administrative access to the cluster.

  • Priority: Warning
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and clusterrolebinding and kcreate and ka.req.binding.role=cluster-admin

Output

Cluster Role Binding to cluster-admin role (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource subjects=%ka.req.binding.subjects role=%ka.req.binding.role resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete clusterrolebinding falco-cluster-admin-binding --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrolebinding falco-cluster-admin-binding --clusterrole=cluster-admin --serviceaccount=default:test
kubectl delete clusterrolebinding falco-cluster-admin-binding

ClusterRole with wildcard created

Detects creation of a Role/ClusterRole with wildcard resources or verbs ("*") in RBAC rules. Such roles greatly expand privileges and often indicate misconfiguration or privilege escalation.

  • Priority: Warning
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kevt and (role or clusterrole) and kcreate and role_with_wildcard

Output

Created Role/ClusterRole with wildcard (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete role falco-wildcard-role-1 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-wildcard-role-1 --verb=create --resource=*
kubectl delete role falco-wildcard-role-1
trap 'kubectl delete role falco-wildcard-role-2 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-wildcard-role-2 --verb=* --resource=pod
kubectl delete role falco-wildcard-role-2
trap 'kubectl delete role falco-wildcard-role-3 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-wildcard-role-3 --verb=* --resource=*
kubectl delete role falco-wildcard-role-3

Attach/Exec Pod

Detects attempts to exec/attach to a Pod (exec/attach subresources) from audit logs. May indicate interactive container access and manual runtime actions.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, container_image_access

Condition

kevt and (jevt.value[/verb] in (get,create,connect)) and (jevt.value[/requestURI] contains "/pods/") and (jevt.value[/requestURI] contains "/exec" or jevt.value[/requestURI] contains "/attach") and not (jevt.value[/impersonatedUser/username] exists and jevt.value[/impersonatedUser/username] in (exec_attach_allowed_users))

Output

Attach/Exec to pod (user=%jevt.value[/user/username] pod=%jevt.value[/objectRef/name] resource=%jevt.value[/objectRef/resource] ns=%jevt.value[/objectRef/namespace] action=%jevt.value[/objectRef/subresource] container_name=%ka.uri.param[container] command=%ka.uri.param[command] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

cleanup() {
  kubectl delete rolebinding falco-exec-user-exec falco-exec-user-pods --ignore-not-found
  kubectl delete role falco-exec-user-exec falco-exec-user-pods --ignore-not-found
  kubectl delete serviceaccount falco-exec-user --ignore-not-found
  kubectl delete pod falco-exec-target --ignore-not-found --grace-period=0
}
# kubectl in a pod drops its in-cluster configuration once --as is given
# and sends the request to http://localhost:8080, so name the API server and the token.
kubectl_as() {
  as=$1
  shift
  sa=/var/run/secrets/kubernetes.io/serviceaccount
  kubectl --server="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" --certificate-authority="$sa/ca.crt" --token="$(cat "$sa/token")" --as="$as" "$@"
}
trap 'cleanup >/dev/null 2>&1 || true' EXIT
kubectl run falco-exec-target --image=mirror.gcr.io/library/ubuntu:24.04 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl create serviceaccount falco-exec-user
kubectl create role falco-exec-user-pods --verb=get,list --resource=pods
kubectl create role falco-exec-user-exec --verb=create,get --resource=pods/exec,pods/attach
kubectl create rolebinding falco-exec-user-pods --role=falco-exec-user-pods --serviceaccount=default:falco-exec-user
kubectl create rolebinding falco-exec-user-exec --role=falco-exec-user-exec --serviceaccount=default:falco-exec-user
kubectl wait pod/falco-exec-target --for=condition=Ready --timeout=60s
kubectl_as system:serviceaccount:default:falco-exec-user exec falco-exec-target -- ls

EphemeralContainers created

Detects adding ephemeral containers to a Pod. Ephemeral containers are often used for debugging but can also be abused for stealthy access.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, container_image_access

Condition

kevt and pod_subresource and kmodify and ka.target.subresource in (ephemeralcontainers)

Output

Ephemeral container is created in pod (user=%ka.user.name pod=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace ephemeral_container_name=%jevt.value[/requestObject/spec/ephemeralContainers/0/name] ephemeral_container_image=%jevt.value[/requestObject/spec/ephemeralContainers/0/image] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete pod falco-debug-target --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl run falco-debug-target --image=mirror.gcr.io/library/ubuntu:24.04 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl wait pod/falco-debug-target --for=condition=Ready --timeout=60s
kubectl debug falco-debug-target --image=mirror.gcr.io/library/alpine:3.22 --target=falco-debug-target

ClusterRole with write privileges created

Detects creation of a Role/ClusterRole with write privileges (create, update, patch, delete). Such roles can modify cluster objects and may be used for escalation or unauthorized changes.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kevt and (role or clusterrole) and kcreate and role_with_write_privs and not role_with_wildcard and not role_with_pod_exec

Output

Created Role/ClusterRole with write privileges (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete role falco-write-role --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-write-role --verb=create,delete --resource=pods
kubectl delete role falco-write-role
trap 'kubectl delete clusterrole falco-write-clusterrole --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-write-clusterrole --verb=create,delete --resource=pods
kubectl delete clusterrole falco-write-clusterrole

ClusterRole with Pod Exec created

Detects creation of a Role/ClusterRole granting access to pods with exec. Exec access allows running commands in containers and often implies high control over workloads.

  • Priority: Warning
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kevt and (jevt.value[/stage]=ResponseComplete) and (jevt.value[/verb]=create) and (jevt.value[/objectRef/resource] in (roles,clusterroles) or jevt.value[/requestURI] contains "/roles" or jevt.value[/requestURI] contains "/clusterroles") and role_with_pod_exec and not (jevt.value[/requestObject/rules] contains "\"*\"" or jevt.value[/requestObject] contains "\"*\"") and not (jevt.value[/impersonatedUser/username] exists and jevt.value[/impersonatedUser/username] in (exec_attach_allowed_users))

Output

Created Role/ClusterRole with pod exec privileges (user=%jevt.value[/user/username] role=%jevt.value[/objectRef/name] resource=%jevt.value[/objectRef/resource] rules=%jevt.value[/requestObject/rules] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

cleanup() {
  kubectl delete role falco-pod-exec-role --ignore-not-found
  kubectl delete rolebinding falco-role-manager falco-role-pod-exec --ignore-not-found
  kubectl delete role falco-role-manager falco-role-pod-exec --ignore-not-found
}
# kubectl in a pod drops its in-cluster configuration once --as is given
# and sends the request to http://localhost:8080, so name the API server and the token.
kubectl_as() {
  as=$1
  shift
  sa=/var/run/secrets/kubernetes.io/serviceaccount
  kubectl --server="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" --certificate-authority="$sa/ca.crt" --token="$(cat "$sa/token")" --as="$as" "$@"
}
trap 'cleanup >/dev/null 2>&1 || true' EXIT
kubectl create role falco-role-manager --verb=create,delete --resource=roles
kubectl create role falco-role-pod-exec --verb=create --resource=pods/exec
kubectl create rolebinding falco-role-manager --role=falco-role-manager --serviceaccount=default:falco-role-user
kubectl create rolebinding falco-role-pod-exec --role=falco-role-pod-exec --serviceaccount=default:falco-role-user
if ! kubectl_as system:serviceaccount:default:falco-role-user create role falco-pod-exec-role --verb=create --resource=pods/exec; then
  echo "system:serviceaccount:default:falco-role-user could not create the role falco-pod-exec-role with pods/exec" >&2
  exit 1
fi
kubectl_as system:serviceaccount:default:falco-role-user delete role falco-pod-exec-role
cleanup() {
  kubectl delete clusterrole falco-pod-exec-clusterrole --ignore-not-found
  kubectl delete clusterrolebinding falco-clusterrole-manager falco-clusterrole-pod-exec --ignore-not-found
  kubectl delete clusterrole falco-clusterrole-manager falco-clusterrole-pod-exec --ignore-not-found
}
# kubectl in a pod drops its in-cluster configuration once --as is given
# and sends the request to http://localhost:8080, so name the API server and the token.
kubectl_as() {
  as=$1
  shift
  sa=/var/run/secrets/kubernetes.io/serviceaccount
  kubectl --server="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" --certificate-authority="$sa/ca.crt" --token="$(cat "$sa/token")" --as="$as" "$@"
}
trap 'cleanup >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-clusterrole-manager --verb=create,delete --resource=clusterroles
kubectl create clusterrole falco-clusterrole-pod-exec --verb=create --resource=pods/exec
kubectl create clusterrolebinding falco-clusterrole-manager --clusterrole=falco-clusterrole-manager --serviceaccount=default:falco-clusterrole-user
kubectl create clusterrolebinding falco-clusterrole-pod-exec --clusterrole=falco-clusterrole-pod-exec --serviceaccount=default:falco-clusterrole-user
if ! kubectl_as system:serviceaccount:default:falco-clusterrole-user create clusterrole falco-pod-exec-clusterrole --verb=create --resource=pods/exec; then
  echo "system:serviceaccount:default:falco-clusterrole-user could not create the clusterrole falco-pod-exec-clusterrole with pods/exec" >&2
  exit 1
fi
kubectl_as system:serviceaccount:default:falco-clusterrole-user delete clusterrole falco-pod-exec-clusterrole

System ClusterRole modified/deleted

Detects modification or deletion of system Role/ClusterRole objects (system:*), with some allowed exceptions. May indicate an attempt to disrupt cluster operation or weaken security.

  • Priority: Warning
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kevt and (role or clusterrole) and (kmodify or kdelete) and (ka.target.name startswith "system:") and not ka.target.name in (system:coredns, system:managed-certificate-controller)

Output

System ClusterRole/Role modified or deleted (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource action=%ka.verb sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl -n kube-system delete role system:test1 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n kube-system create role system:test1 --verb=create --resource=pods
kubectl -n kube-system delete role system:test1
trap 'kubectl delete clusterrole system:test2 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole system:test2 --verb=create --resource=pods
kubectl delete clusterrole system:test2

K8s ServiceAccount created

Detects ServiceAccount creation outside system namespaces. Can be normal for apps but is also used to prepare access and later grant RBAC privileges.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and kcreate and serviceaccount and not system_namespace and response_successful

Output

K8s Serviceaccount Created (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete namespace falco-sa-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl get namespace falco-sa-created >/dev/null 2>&1 || kubectl create namespace falco-sa-created
kubectl -n falco-sa-created create serviceaccount falco-sa-created
kubectl -n falco-sa-created delete serviceaccount falco-sa-created

K8s ModuleConfig modified

Detects modifications to ModuleConfig objects from audit logs. ModuleConfig changes can affect component behavior and security settings and should be monitored.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and writable_verbs and moduleconfig and response_successful

Output

K8s ModuleConfig changed (user=%ka.user.name verb=%ka.verb moduleconfig=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

kubectl annotate moduleconfig runtime-audit-engine falco-test.deckhouse.io/touched=true --overwrite
kubectl annotate moduleconfig runtime-audit-engine falco-test.deckhouse.io/touched-

K8s ServiceAccount deleted

Detects ServiceAccount deletion from audit logs. May indicate access artifact cleanup or changes in application/service configuration.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and kdelete and serviceaccount and response_successful

Output

K8s Serviceaccount Deleted (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete serviceaccount falco-sa-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create serviceaccount falco-sa-deleted
kubectl delete serviceaccount falco-sa-deleted

K8s Role/ClusterRole created

Detects Role/ClusterRole creation from audit logs. Used to monitor RBAC changes and spot unexpected privilege expansion.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and kcreate and (clusterrole or role) and response_successful and not role_with_wildcard and not role_with_pod_exec and not role_with_write_privs

Output

K8s Cluster Role Created (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete role falco-role-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-role-created --verb=get --resource=pods
kubectl delete role falco-role-created
trap 'kubectl delete clusterrole falco-clusterrole-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-clusterrole-created --verb=get --resource=pods
kubectl delete clusterrole falco-clusterrole-created

K8s Role/ClusterRole deleted

Detects Role/ClusterRole deletion from audit logs. May indicate cover-up attempts, rollback of access configuration, or disruptive changes.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and kdelete and (clusterrole or role) and response_successful and not (ka.target.name startswith "system:")

Output

K8s Cluster Role Deleted (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete role falco-role-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-role-deleted --verb=create --resource=pods
kubectl delete role falco-role-deleted
trap 'kubectl delete clusterrole falco-clusterrole-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-clusterrole-deleted --verb=create --resource=pods
kubectl delete clusterrole falco-clusterrole-deleted

K8s ClusterRoleBinding created

Detects ClusterRoleBinding creation from audit logs. ClusterRoleBindings change cluster-wide permission assignments and can be a privilege escalation vector.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and kcreate and clusterrolebinding and response_successful and not ka.req.binding.role=cluster-admin

Output

K8s Cluster Role Binding Created (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource subjects=%ka.req.binding.subjects role=%ka.req.binding.role resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete clusterrolebinding falco-crb-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrolebinding falco-crb-created --clusterrole=view --serviceaccount=default:test
kubectl delete clusterrolebinding falco-crb-created

K8s ClusterRoleBinding deleted

Detects ClusterRoleBinding deletion from audit logs. May cause loss of access or be used to hide unauthorized bindings.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, rbac_drift

Condition

kactivity and kdelete and clusterrolebinding and response_successful

Output

K8s Cluster Role Binding Deleted (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host

Commands:

trap 'kubectl delete clusterrolebinding falco-crb-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrolebinding falco-crb-deleted --clusterrole=view --serviceaccount=default:test
kubectl delete clusterrolebinding falco-crb-deleted

Read below containerd images dir

Detects reading files under containerd directories related to CRI container data. May indicate attempts to extract container/image information or unusual runtime data access.

  • Priority: Notice
  • Source: Syscall
  • Tags: fstec, container_image_access

Condition

fd.name startswith /var/lib/containerd/io.containerd.grpc.v1.cri/containers/ and open_read and not (proc.name in (allowed_proc_names) or proc.pname in (allowed_proc_names) or containerd_allowed_paths)

Output

File below a known containerd directory opened for reading (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline proc.aname[1]=%proc.aname[1] gparent=%proc.aname[2] proc.aname[3]=%proc.aname[3] vpid=%proc.vpid container_id=%container.id image=%container.image.repository)

How to test

  • Environment: host

Commands:

mkdir -p /var/lib/containerd/io.containerd.grpc.v1.cri/containers
echo "Hello Falco!" > /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-read-test
cat /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-read-test
rm /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-read-test

Write below containerd images dir

Detects writes/modifications under containerd directories. May indicate runtime data tampering, drift, or supply-chain related attacks targeting container data.

  • Priority: Error
  • Source: Syscall
  • Tags: fstec, container_image_drift

Condition

fd.directory startswith /var/lib/containerd and open_write and not (proc.name in (allowed_proc_names) or proc.pname in (allowed_proc_names) or containerd_allowed_paths)

Output

File below a known containerd directory opened for writing (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline proc.aname[1]=%proc.aname[1] gparent=%proc.aname[2] proc.aname[3]=%proc.aname[3] vpid=%proc.vpid container_id=%container.id image=%container.image.repository)

How to test

  • Environment: host

Commands:

mkdir -p /var/lib/containerd/io.containerd.grpc.v1.cri/containers
echo Hello Falco! > /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-write-test
cat /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-write-test
rm /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-write-test

Container tag is not @sha256

Detects Pod creation in a system namespace using an image not pinned by digest (@sha256:). Using mutable tags weakens integrity controls and increases the risk of image substitution.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, integrity_control

Condition

kactivity and kcreate and pod and response_successful and system_namespace and not (ka.req.container.image contains @sha256:) and not (ka.target.namespace="d8-system" and ka.target.name startswith "deckhouse-")

Output

Not all containers are running with the sha256 sum as a tag in a system namespace, which is a potential integrity control mechanism misconfiguration (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason image=%ka.req.pod.containers.image sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

How to test

  • Environment: host
  • Conditions:
    • bundle: CSE

Commands:

trap 'kubectl -n d8-system delete pod falco-tag-not-sha256 --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl -n d8-system run falco-tag-not-sha256 --image=mirror.gcr.io/library/ubuntu:24.04 --override-type=strategic --overrides='{"spec":{"securityContext":{"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"containers":[{"name":"falco-tag-not-sha256","securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}}]}}' -- /bin/sh -c "while true; do sleep 3600; done"
kubectl -n d8-system delete pod falco-tag-not-sha256 --grace-period=0

Inbound SSH Connection Attempt

Detects inbound SSH connection attempts to port 22 on the host, including failed authentication. The username is not available at this stage. To capture usernames for failed authentication attempts, configure security events based on sshd logs.

  • Priority: Notice
  • Source: Syscall
  • Tags: fstec, auth_attempts

Condition

evt.type in (accept,listen) and fd.sport=22 and proc.name=sshd

Output

Inbound SSH Connection Attempt (src_ip=%fd.cip connection=%fd.name container_id=%container.id)

How to test

  • Environment: host

Commands:

set -eu

USER_NAME=falco-test-attempt
KEY=./id_ed25519_attempt

rm -f "$KEY" "$KEY.pub"
ssh-keygen -t ed25519 -N '' -f "$KEY" -q

kubectl apply -f -<<EOF
apiVersion: deckhouse.io/v1
kind: NodeUser
metadata:
  name: $USER_NAME
spec:
  isSudoer: false
  nodeGroups:
  - '*'
  sshPublicKeys:
  - $(cat "$KEY.pub")
  uid: 1224
EOF

trap 'kubectl delete nodeuser/$USER_NAME --ignore-not-found >/dev/null 2>&1 || true' EXIT

# A node without an ExternalIP is reached at its InternalIP, which a pod can reach too.
NODE_IP=$(kubectl get nodes -l node.deckhouse.io/deckhouse-ready=true -o json | jq -r '[.items[].status.addresses[]? | select(.type=="ExternalIP") | .address] + [.items[].status.addresses[]? | select(.type=="InternalIP") | .address] | .[0] // empty')
if [ -z "$NODE_IP" ]; then
  echo "no Ready node exposes an ExternalIP or an InternalIP, cannot test inbound SSH" >&2
  exit 1
fi

# Provisioning the NodeUser onto the node is asynchronous, and the object
# carries no condition to wait on - "kubectl wait --for=jsonpath=
# '{.metadata.name}'=$USER_NAME" only asserts the name equals itself and
# returns at once. So poll the login instead of sleeping a fixed guess:
# until the key reaches the node the login gets refused, which produces a
# connection attempt but no shell, and reports as "Cmd: OK, Log: FAIL".
i=0
until ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=10 -i "$KEY" "$USER_NAME@$NODE_IP" true 2>/dev/null; do
  i=$((i + 1))
  if [ "$i" -ge 30 ]; then
    echo "$USER_NAME could not log in to $NODE_IP after $((i * 10))s; the NodeUser never reached the node" >&2
    exit 1
  fi
  sleep 10
done

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -i "$KEY" "$USER_NAME@$NODE_IP" "ls -la && sleep 30"

Inbound SSH Connection

Detects successful inbound SSH connections to port 22 on the host. Triggers when sshd spawns a login shell after successful authentication. The username is resolved via the k8s-nodeuser-info plugin (nodeusers.deckhouse.io) by login UID; this only works for Deckhouse NodeUser accounts. For other users, only the numeric UID is available — configure security events based on sshd logs to capture usernames for non-NodeUser accounts.

  • Priority: Notice
  • Source: Syscall
  • Tags: fstec, auth_attempts

Condition

spawned_process and proc.pname=sshd and not proc.name in (sshd, ssh-keygen, sshd-keygen)

Output

Inbound SSH Connection (user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid shell=%proc.name parent=%proc.pname src_ip=%fd.cip connection=%fd.name container_id=%container.id)

How to test

  • Environment: host

Commands:

set -eu

USER_NAME=falco-test-login
KEY=./id_ed25519_login

rm -f "$KEY" "$KEY.pub"
ssh-keygen -t ed25519 -N '' -f "$KEY" -q

kubectl apply -f -<<EOF
apiVersion: deckhouse.io/v1
kind: NodeUser
metadata:
  name: $USER_NAME
spec:
  isSudoer: false
  nodeGroups:
  - '*'
  sshPublicKeys:
  - $(cat "$KEY.pub")
  uid: 1225
EOF

trap 'kubectl delete nodeuser/$USER_NAME --ignore-not-found >/dev/null 2>&1 || true' EXIT

# A node without an ExternalIP is reached at its InternalIP, which a pod can reach too.
NODE_IP=$(kubectl get nodes -l node.deckhouse.io/deckhouse-ready=true -o json | jq -r '[.items[].status.addresses[]? | select(.type=="ExternalIP") | .address] + [.items[].status.addresses[]? | select(.type=="InternalIP") | .address] | .[0] // empty')
if [ -z "$NODE_IP" ]; then
  echo "no Ready node exposes an ExternalIP or an InternalIP, cannot test inbound SSH" >&2
  exit 1
fi

# Provisioning the NodeUser onto the node is asynchronous, and the object
# carries no condition to wait on - "kubectl wait --for=jsonpath=
# '{.metadata.name}'=$USER_NAME" only asserts the name equals itself and
# returns at once. So poll the login instead of sleeping a fixed guess:
# until the key reaches the node the login gets refused, which produces a
# connection attempt but no shell, and reports as "Cmd: OK, Log: FAIL".
i=0
until ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=10 -i "$KEY" "$USER_NAME@$NODE_IP" true 2>/dev/null; do
  i=$((i + 1))
  if [ "$i" -ge 30 ]; then
    echo "$USER_NAME could not log in to $NODE_IP after $((i * 10))s; the NodeUser never reached the node" >&2
    exit 1
  fi
  sleep 10
done

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -i "$KEY" "$USER_NAME@$NODE_IP" "ls -la && sleep 30"

Unauthorized request to Kubernetes API

Detects Kubernetes API requests resulting in HTTP 401 (Unauthorized) in audit logs (excluding common health and version endpoints). May indicate token guessing, misconfigured clients, or attacker activity.

  • Priority: Warning
  • Source: K8sAudit
  • Tags: fstec, auth_attempts

Condition

ka.response.code=401 and not jevt.value[/requestURI] startswith /version and not jevt.value[/requestURI] in (/healthz, /readyz, /livez)

Output

Unauthorized K8s API request detected
user=%jevt.value[/user/username]
agents=%jevt.value[/userAgent]
verb=%jevt.value[/verb]
uri=%jevt.value[/requestURI]
src_ip=%jevt.value[/sourceIPs]
dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0]
dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0]

How to test

  • Environment: host

Commands:

curl -k https://$(kubectl -n default get svc kubernetes -o json | jq -r ".spec.clusterIP")/auth/test -H 'Authorization: Bearer TEST'

Security Reports Created

Detects creation of security report resources (configauditreports/vulnerabilityreports). May indicate a scan run, new vulnerability findings, or security-related container activity.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: fstec, security_reports

Condition

kevt and kcreate and ka.target.resource in (security_reports)

Output

K8s Security Reports Created. The report may contain vulnerability information. Check the object in the cluster (user=%ka.user.name, verb=%ka.verb, ns=%ka.target.namespace, resource=%ka.target.resource, object=%ka.target.name sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

D8IntegrityCheck

Missing digital signature

One of the binary files used by Deckhouse system components has failed the signature verification. Check the logs of the d8-bcheck utility and contact technical support.

  • Priority: Error
  • Source: Syscall
  • Tags: integrity_check, subscription_check

Condition

open_write_append and bin_dir and proc_name

Output

Deckhouse binary %fd.name is missing a proper digital signature

Event with deckhouse.io/signature annotation

A Kubernetes API event with the deckhouse.io/signature annotation was detected. Indicates that unsigned objects or objects with invalid signatures were found in the etcd database.

  • Priority: Notice
  • Source: K8sAudit
  • Tags: integrity_check, signature

Condition

kevt and jevt.value[/annotations/deckhouse.io~1signature] exists

Output

K8s audit event with deckhouse.io/signature annotation. Indicates that unsigned objects or objects with invalid signatures were found in the etcd database. (user=%ka.user.name verb=%ka.verb resource=%ka.target.resource object=%ka.target.name signature=%jevt.value[/annotations/deckhouse.io~1signature])