SetUp

it is important to note that the inputs have not been checked (their worth and size and noise), that will happen in the next stages as I go through the detections and tune them. I wanted to get every log possible and play with them in splunk so these may be noisy but in each detection I will mention what log source it came from and then you can choose to add it or not.(although some noisy ones are disabled right now.)

Auditd

first I added these to my auditd rules specifically for access to docker files.

-w /var/lib/docker -p rwxa -k docker
-w /etc/docker -p rwxa -k docker
-w /lib/systemd/system/docker.service -p rwxa -k docker
-w /lib/systemd/system/docker.socket -p rwxa -k docker
-w /etc/default/docker -p rwxa -k docker
-w /etc/docker/daemon.json -p rwxa -k docker
-w /usr/bin/docker-containerd -p rwxa -k docker
-w /usr/bin/docker-runc -p rwxa -k docker
-w /usr/bin/dockerd -p rwxa -k docker
-w /var/run/docker.sock -p rwxa -k docker

the source that I used for this is https://urielwilson.com/securing-your-docker-environment-with-auditd-a-step-by-step-guide/

Falco

I tried to do this without falco but I was missing so much so i installed falco, in the config file I added it to ouput_file as json into my desired file and then I added it to the UF's input. at first some rules like "Launch Privileged Container" was not working so I added falco-sandbox_rules.yaml and falco-incubating_rules.yaml (experimental/noisy rules from falco itself) as well.

rules_files:
  - /etc/falco/falco_rules.yaml
  - /etc/falco/falco-incubating_rules.yaml
  - /etc/falco/falco-sandbox_rules.yaml
  - /etc/falco/falco_rules.local.yaml
  - /etc/falco/rules.d

UF inputs.conf

[monitor:///var/log/auth.log]
disabled = false
index = linux
sourcetype = linux_secure

[monitor:///var/log/syslog]
disabled = false
index = linux
sourcetype = syslog

[monitor:///var/log/*.log]
disabled = true
index = linux
sourcetype = linux_log

[monitor:///var/log/audit/audit.log]
disabled = false
index = linux
sourcetype = auditd


[monitor:///etc/docker/daemon.json]
disabled = false
index = docker
sourcetype = docker:daemon:config

[monitor:///etc/docker]
disabled = false
index = docker
sourcetype = docker:etc:config
recursive = true
blacklist = (daemon\.json|key\.json|\.key|\.pem|\.crt)$|/certs\.d/

[monitor:///lib/systemd/system/docker.service]
disabled = false
index = docker
sourcetype = docker:service:unit

[monitor:///lib/systemd/system/docker.socket]
disabled = false
index = docker
sourcetype = docker:socket:unit

[monitor:///etc/default/docker]
disabled = false
index = docker
sourcetype = docker:default:env

[monitor:///etc/containerd/config.toml]
disabled = false
index = docker
sourcetype = docker:containerd:config

[monitor:///var/lib/docker/containers/*/config.v2.json]
disabled = false
index = docker
sourcetype = docker:container:config

[monitor:///var/lib/docker/containers/*/hostconfig.json]
disabled = false
index = docker
sourcetype = docker:container:hostconfig

[monitor:///var/lib/docker/containers/*/*-json.log]
disabled = false
index = docker
sourcetype = docker:container:log

[monitor:///var/log/falco/events.log]
index = falco
sourcetype = falco:json
disabled = false

then for the parsing I used Splunk Add-on for Unix and Linux and set my sourcetype to auditd

---

Privileged Docker Container

The Attack Simulation

(these demonstrations of the capabilities were from this great presentation https://www.aparat.com/v/n09upbf?playlist=1594736) when you run the container without special privileges there is a lot you can't do.

mounting a directory:

limited capabilities:

but if you use --privileged for all the capabilities then you have way more access and it overrides AppArmor/SELinux restrictions!

directory mounting:

all the capabilities:

---

DSJ Detections

so now that we know how important and unsafe --privileged is we need to monitor it.

1.Privileged Docker Container Creation via EXECVE

index=linux sourcetype=auditd type=EXECVE execve_command="*docker*" execve_command="*run*" execve_command="*--privileged*"
| fillnull value="-" 
| stats min(_time) as firstTime max(_time) as lastTime count by msg execve_command
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`

the down side of this is that you will not capture it in sudo su mode.

2.Privileged Docker Container Creation via Falco

the rule was "Launch Privileged Container" from maturity_incubating

index=falco rule="Launch Privileged Container"  
| fillnull value="-" 
| stats min(_time) as firstTime max(_time) as lastTime count by hostname output_fields.container.name output_fields.container.id output_fields.evt.type output_fields.proc.exepath output_fields.proc.cmdline output_fields.user.name rule 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`

I would add these to a dashboard instead of the usual rules because there are a handful legitimate images that need this but if the admin of the docker can fill and maintain user_privileged_containers macro within the Falco it would be a high confidence case for alerting