[TRACKING] "drop+exec" kernel signal correlations detections + threat modeling beyond

[incertum]

This issue is for tracking the development of a more generic and robust solution to detect the classic drop an implant and execute it TTP called "drop+exec". In addition, perform threat modeling not limited to this use case, e.g. "fileless" attacks or malicious scripts run by interpreter ...

Please follow initial discussion in #595 by @loresuso, @LucaGuerra and @incertum for additional context.

Documentation:
@leogr could we create a hackmd doc you own/ track titled "Falco Detections - Threat Modeling - drop+exec use case" or similar? Thank you!

Next engineering steps:

• Test and merge once ready after rebase new: introduce is_exe_upper_layer #287 (@loresuso)
• Finalize, test and merge new(driver, libsinsp, libscap): Add kernel signals exe_ino, exe_ino_ctime, exe_ino_mtime, pidns_init_start_ts + derived filter fields #595 (@incertum)
• New PR for userspace modeling - kernel signal correlations detections for initial "drop+exec" use case (@LucaGuerra, @loresuso , @incertum and everyone else who wants to contribute 😄 )
• Above possibly accompanied by a proposal doc PR

[leogr]

Sure! 😃

👉 https://hackmd.io/@leogr/SJKUMEbWo

[loresuso]

@incertum just rebased #287!
I've also written a proposal in the hackmd to detect fileless execution. Feedback is highly appreciated!

[incertum]

Amazing will take a look! @loresuso made some suggestions in the doc on how to maybe simplify "memfd+exec", have 100% confidence that this is doable and sane and would suggest to implement it rather sooner than later if possible.

Would you want to take a crack at opening a PR for this when you get to it 😄 🚀 ? Feel free to plan me in for helping testing it as well! This is really good stuff.

[loresuso]

Thank you @incertum for all the comments! I will start experimenting soon, and I will keep you posted on this 🙂 And yes, any help in testing this kind of PRs is always welcome 🙏

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[incertum]

See HackMD and we also made progress and merged @loresuso and my PR. Next is likely @loresuso "memfd+exec" signal and "userland exec" it's in the back of my head, however no true inspiration yet ...

[leogr]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[incertum]

/remove-lifecycle stale

[incertum]

Seems we are on track for the initial TTPs we wanted to address. Future threat modeling shall we continued in new issues.