Falco – Falco Rules

Docs: Rule fields

Mon, 01 Jan 0001 00:00:00 +0000

A Falco rule can contain the following keys:

Key	Required	Description	Default
`rule`	yes	A short, unique name for the rule.
`condition`	yes	A filtering expression that is applied against events to check whether they match the rule.
`desc`	yes	A longer description of what the rule detects.
`output`	yes	Specifies the message that should be output if a matching event occurs. See output.
`priority`	yes	A case-insensitive representation of the severity of the event. Should be one of the following: `emergency`, `alert`, `critical`, `error`, `warning`, `notice`, `informational`, `debug`.
`exceptions`	no	A set of exceptions that cause the rule to not generate an alert.
`enabled`	no	If set to `false`, a rule is neither loaded nor matched against any events.	`true`
`tags`	no	A list of tags applied to the rule (more on this below).
`warn_evttypes`	no	If set to `false`, Falco suppresses warnings related to a rule not having an event type (more on this below).	`true`
`skip-if-unknown-filter`	no	If set to `true`, if a rule conditions contains a filtercheck, e.g. `fd.some_new_field`, that is not known to this version of Falco, Falco silently accepts the rule but does not execute it; if set to `false`, Falco reports an error and exists when finding an unknown filtercheck.	`false`
`source`	no	The event source for which this rule should be evaluated. Typical values are `syscall`, `k8s_audit`, or the source advertised by a source plugin.	`syscall`
`append`	no	When set to `true`, it adds conditions and/or exceptions to a previously defined rule or macro instead of overseeding it. Not used when the goal is just to enable an already existing rule. In case of appending to a list, it adds new elements to it.

Docs: Default Macros

Mon, 01 Jan 0001 00:00:00 +0000

The default Falco rule set defines a number of macros that makes it easier to start writing rules. These macros provide shortcuts for a number of common scenarios and can be used in any user defined rule sets.

Falco also provide Macros that should be overridden. Refer here for further information.

File Opened for Writing

- macro: open_write
 condition: (evt.type=open or evt.type=openat) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0

File Opened for Reading

- macro: open_read
 condition: (evt.type=open or evt.type=openat) and evt.is_open_read=true and fd.typechar='f' and fd.num>=0

Never True

- macro: never_true
 condition: (evt.num=0)

Always True

- macro: always_true
 condition: (evt.num=>0)

Proc Name is Set

- macro: proc_name_exists
 condition: (proc.name!="<NA>")

File System Object Renamed

- macro: rename
 condition: evt.type in (rename, renameat)

New Directory Created

- macro: mkdir
 condition: evt.type = mkdir

File System Object Removed

- macro: remove
 condition: evt.type in (rmdir, unlink, unlinkat)

File System Object Modified

- macro: modify
 condition: rename or remove

New Process Spawned

- macro: spawned_process
 condition: (evt.type in (execve, execveat))

Common Directories for Binaries

- macro: bin_dir
 condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)

Shell is Started

- macro: shell_procs
 condition: (proc.name in (shell_binaries))

Known Sensitive Files

- macro: sensitive_files
 condition: >
 fd.name startswith /etc and
 (fd.name in (sensitive_file_names)
 or fd.directory in (/etc/sudoers.d, /etc/pam.d))

Newly Created Process

- macro: proc_is_new
 condition: proc.duration <= 5000000000

Inbound Network Connections

- macro: inbound
 condition: >
 ((evt.type in (accept,listen)) or
 (fd.typechar = 4 or fd.typechar = 6) and
 (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS))

Outbound Network Connections

- macro: outbound
 condition: >
 ((evt.type = connect) or
 (fd.typechar = 4 or fd.typechar = 6) and
 (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS))

Inbound or Outbound Network Connections

- macro: inbound_outbound
 condition: >
 ((evt.type in (accept,listen,connect)) or
 (fd.typechar = 4 or fd.typechar = 6) and
 (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS))

Object is a Container

- macro: container
 condition: container.id != host

Interactive Process Spawned

- macro: interactive
 condition: >
 ((proc.aname=sshd and proc.name != sshd) or
 proc.name=systemd-logind or proc.name=login)

Docs: Macros to Override

Mon, 01 Jan 0001 00:00:00 +0000

Falco also provide Macros that should be overridden by the user to provide settings that are specific to a user's environment. The provided Macros can also be appended to in a local rules file.

The below macros contain values that can be overridden for a user's specific environment.

Common SSH Port

Override this macro to reflect ports in your environment that provide SSH services.

- macro: ssh_port
 condition: fd.sport=22

Allowed SSH Hosts

Override this macro to reflect hosts that can connect to known SSH ports (ie a bastion or jump box).

- macro: allowed_ssh_hosts
 condition: ssh_port

User Trusted Containers

Allowlist containers that are allowed to run in privileged mode.

- macro: user_trusted_containers
 condition: (container.image startswith sysdig/agent)

Containers Allowed to Spawn Shells

Allowlist containers that are allowed to spawn shells, which may be needed if containers are used in the CI/CD pipeline.

- macro: user_shell_container_exclusions
 condition: (never_true)

Containers Allowed to Communicate with EC2 Metadata Services

Allowlist containers that are allowed to communicate with the EC2 metadata service. Default: any container.

- macro: ec2_metadata_containers
 condition: container

Kubernetes API Server

Set the IP of your Kubernetes API Service here.

- macro: k8s_api_server
 condition: (fd.sip="1.2.3.4" and fd.sport=8080)

Containers Allowed to Communicate with the Kubernetes API

Allowlist containers that are allowed to communicate with the Kubernetes API Service. Requires k8s_api_server being set.

- macro: k8s_containers
 condition: >
 (container.image startswith gcr.io/google_containers/hyperkube-amd64 or
 container.image startswith gcr.io/google_containers/kube2sky or
 container.image startswith sysdig/agent or
 container.image startswith sysdig/falco or
 container.image startswith sysdig/sysdig)

Containers Allowed to Communicate with Kubernetes Service NodePorts

- macro: nodeport_containers
 condition: container

Docs: Supported Events

Mon, 01 Jan 0001 00:00:00 +0000

Here are the system call event types and args supported by the kernel module and eBPF probes via libscap included in the Falco libs. Note that, for performance reasons, by default Falco will only consider a subset of them indicated in the table below with "yes". However, it's possible to make Falco consider all events by using the -A command line switch.

Note that several event types exist:

Syscall events correspond to Linux system calls. Most of them have parameters, documented below, while some are detected as generic and they only offer the syscall ID.
Tracepoint events represent internal kernel events that may be significant but don't directly translate to any syscall.
Metaevents are generated from supplementary data sources, for instance, during data enrichment procedures or when the need for asynchronous actions arises. This group also encompasses some of Falco's internally produced events (such as the drop event) that are unavailable for rules.
Plugin events act as an envelope for actual plugin event data. In order to write rules that use plugins use the fields documented in the individual plugin.

The events below are valid for Falco Schema Version: 4.1.0

Syscall events

Default	Dir	Name	Params
Yes	`>`	`open`	FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode
Yes	`<`	`open`	FD fd, FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, UINT32 dev, UINT64 ino
Yes	`<`	`close`	ERRNO res, FD fd
No	`<`	`read`	ERRNO res, BYTEBUF data, FD fd, UINT32 size
No	`<`	`write`	ERRNO res, BYTEBUF data, FD fd, UINT32 size
Yes	`<`	`socket`	FD fd, ENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto
Yes	`<`	`bind`	ERRNO res, SOCKADDR addr, FD fd
Yes	`>`	`connect`	FD fd, SOCKADDR addr
Yes	`<`	`connect`	ERRNO res, SOCKTUPLE tuple, FD fd, SOCKADDR addr
Yes	`<`	`listen`	ERRNO res, FD fd, INT32 backlog
No	`<`	`send`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple
Yes	`<`	`sendto`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple
No	`<`	`recv`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple
Yes	`<`	`recvfrom`	ERRNO res, BYTEBUF data, SOCKTUPLE tuple, FD fd, UINT32 size
Yes	`<`	`shutdown`	ERRNO res, FD fd, ENUMFLAGS8 how: SHUT_UNKNOWN, SHUT_RDWR, SHUT_WR, SHUT_RD
Yes	`<`	`getsockname`
Yes	`<`	`getpeername`
Yes	`<`	`socketpair`	ERRNO res, FD fd1, FD fd2, UINT64 source, UINT64 peer, ENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto
Yes	`<`	`setsockopt`	ERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen
Yes	`<`	`getsockopt`	ERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen
Yes	`<`	`sendmsg`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple
Yes	`<`	`sendmmsg`	ERRNO res, FD fd, UINT32 size, BYTEBUF data, SOCKTUPLE tuple
Yes	`<`	`recvmsg`	ERRNO res, UINT32 size, BYTEBUF data, SOCKTUPLE tuple, BYTEBUF msgcontrol, FD fd
Yes	`<`	`recvmmsg`	ERRNO res, FD fd, UINT32 size, BYTEBUF data, SOCKTUPLE tuple, BYTEBUF msgcontrol
Yes	`>`	`creat`	FSPATH name, UINT32 mode
Yes	`<`	`creat`	FD fd, FSPATH name, UINT32 mode, UINT32 dev, UINT64 ino, FLAGS16 creat_flags: FD_UPPER_LAYER_CREAT, FD_LOWER_LAYER_CREAT
Yes	`<`	`pipe`	ERRNO res, FD fd1, FD fd2, UINT64 ino
Yes	`<`	`eventfd`	FD res, UINT64 initval, UINT32 flags
Yes	`<`	`futex`	ERRNO res, UINT64 addr, FLAGS16 op: FUTEX_CLOCK_REALTIME, FUTEX_PRIVATE_FLAG, FUTEX_CMP_REQUEUE_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_WAKE_BITSET, FUTEX_WAIT_BITSET, FUTEX_TRYLOCK_PI, FUTEX_UNLOCK_PI, FUTEX_LOCK_PI, FUTEX_WAKE_OP, FUTEX_CMP_REQUEUE, FUTEX_REQUEUE, FUTEX_FD, FUTEX_WAKE, FUTEX_WAIT, UINT64 val
Yes	`<`	`stat`	ERRNO res, FSPATH path
Yes	`<`	`lstat`	ERRNO res, FSPATH path
Yes	`<`	`fstat`	ERRNO res, FD fd
Yes	`<`	`stat64`	ERRNO res, FSPATH path
Yes	`<`	`lstat64`	ERRNO res, FSPATH path
Yes	`<`	`fstat64`	ERRNO res
Yes	`<`	`epoll_wait`	ERRNO res, ERRNO maxevents
Yes	`<`	`poll`	ERRNO res, FDLIST fds, INT64 timeout
Yes	`<`	`select`	ERRNO res
Yes	`<`	`lseek`	ERRNO res, FD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET
Yes	`<`	`llseek`	ERRNO res, FD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET
Yes	`<`	`getcwd`	ERRNO res, CHARBUF path
Yes	`<`	`chdir`	ERRNO res, CHARBUF path
Yes	`<`	`fchdir`	ERRNO res, FD fd
No	`<`	`pread`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, UINT64 pos
No	`<`	`pwrite`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, UINT64 pos
No	`<`	`readv`	ERRNO res, UINT32 size, BYTEBUF data, FD fd
No	`<`	`writev`	ERRNO res, BYTEBUF data, FD fd, UINT32 size
No	`<`	`preadv`	ERRNO res, UINT32 size, BYTEBUF data, FD fd, UINT64 pos
No	`<`	`pwritev`	ERRNO res, BYTEBUF data, FD fd, UINT32 size, UINT64 pos
Yes	`<`	`signalfd`	FD res, FD fd, UINT32 mask, UINT8 flags
Yes	`<`	`kill`	ERRNO res, PID pid, SIGTYPE sig
Yes	`<`	`tkill`	ERRNO res, PID tid, SIGTYPE sig
Yes	`<`	`tgkill`	ERRNO res, PID pid, PID tid, SIGTYPE sig
Yes	`<`	`nanosleep`	ERRNO res, RELTIME interval
Yes	`<`	`timerfd_create`	FD res, UINT8 clockid, UINT8 flags
Yes	`<`	`inotify_init`	FD res, UINT8 flags
Yes	`<`	`getrlimit`	ERRNO res, INT64 cur, INT64 max, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes	`<`	`setrlimit`	ERRNO res, INT64 cur, INT64 max, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes	`<`	`prlimit`	ERRNO res, INT64 newcur, INT64 newmax, INT64 oldcur, INT64 oldmax, INT64 pid, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes	`<`	`fcntl`	FD res, FD fd, ENUMFLAGS8 cmd: F_GETPIPE_SZ, F_SETPIPE_SZ, F_NOTIFY, F_DUPFD_CLOEXEC, F_CANCELLK, F_GETLEASE, F_SETLEASE, F_GETOWN_EX, F_SETOWN_EX, F_SETLKW64, F_SETLK64, F_GETLK64, F_GETSIG, F_SETSIG, F_GETOWN, F_SETOWN, F_SETLKW, F_SETLK, F_GETLK, F_SETFL, F_GETFL, F_SETFD, F_GETFD, F_DUPFD, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW, UNKNOWN
Yes	`<`	`brk`	UINT64 res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr
Yes	`<`	`mmap`	ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 offset
Yes	`<`	`mmap2`	ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 pgoffset
Yes	`<`	`munmap`	ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr, UINT64 length
Yes	`<`	`splice`	ERRNO res, FD fd_in, FD fd_out, UINT64 size, FLAGS32 flags: SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT
Yes	`<`	`ptrace`	ERRNO res, DYNAMIC addr, DYNAMIC data, ENUMFLAGS16 request: PTRACE_SINGLEBLOCK, PTRACE_SYSEMU_SINGLESTEP, PTRACE_SYSEMU, PTRACE_ARCH_PRCTL, PTRACE_SET_THREAD_AREA, PTRACE_GET_THREAD_AREA, PTRACE_OLDSETOPTIONS, PTRACE_SETFPXREGS, PTRACE_GETFPXREGS, PTRACE_SETFPREGS, PTRACE_GETFPREGS, PTRACE_SETREGS, PTRACE_GETREGS, PTRACE_SETSIGMASK, PTRACE_GETSIGMASK, PTRACE_PEEKSIGINFO, PTRACE_LISTEN, PTRACE_INTERRUPT, PTRACE_SEIZE, PTRACE_SETREGSET, PTRACE_GETREGSET, PTRACE_SETSIGINFO, PTRACE_GETSIGINFO, PTRACE_GETEVENTMSG, PTRACE_SETOPTIONS, PTRACE_SYSCALL, PTRACE_DETACH, PTRACE_ATTACH, PTRACE_SINGLESTEP, PTRACE_KILL, PTRACE_CONT, PTRACE_POKEUSR, PTRACE_POKEDATA, PTRACE_POKETEXT, PTRACE_PEEKUSR, PTRACE_PEEKDATA, PTRACE_PEEKTEXT, PTRACE_TRACEME, PTRACE_UNKNOWN, PID pid
Yes	`<`	`ioctl`	ERRNO res, FD fd, UINT64 request, UINT64 argument
Yes	`<`	`rename`	ERRNO res, FSPATH oldpath, FSPATH newpath
Yes	`<`	`renameat`	ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath
Yes	`<`	`symlink`	ERRNO res, CHARBUF target, FSPATH linkpath
Yes	`<`	`symlinkat`	ERRNO res, CHARBUF target, FD linkdirfd, FSRELPATH linkpath
No	`<`	`sendfile`	ERRNO res, UINT64 offset, FD out_fd, FD in_fd, UINT64 size
Yes	`<`	`quotactl`	ERRNO res, CHARBUF special, CHARBUF quotafilepath, UINT64 dqb_bhardlimit, UINT64 dqb_bsoftlimit, UINT64 dqb_curspace, UINT64 dqb_ihardlimit, UINT64 dqb_isoftlimit, RELTIME dqb_btime, RELTIME dqb_itime, RELTIME dqi_bgrace, RELTIME dqi_igrace, FLAGS8 dqi_flags: DQF_NONE, V1_DQF_RSQUASH, FLAGS8 quota_fmt_out: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1, FLAGS16 cmd: Q_QUOTAON, Q_QUOTAOFF, Q_GETFMT, Q_GETINFO, Q_SETINFO, Q_GETQUOTA, Q_SETQUOTA, Q_SYNC, Q_XQUOTAON, Q_XQUOTAOFF, Q_XGETQUOTA, Q_XSETQLIM, Q_XGETQSTAT, Q_XQUOTARM, Q_XQUOTASYNC, FLAGS8 type: USRQUOTA, GRPQUOTA, UINT32 id, FLAGS8 quota_fmt: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1
Yes	`<`	`setresuid`	ERRNO res, UID ruid, UID euid, UID suid
Yes	`<`	`setresgid`	ERRNO res, GID rgid, GID egid, GID sgid
Yes	`<`	`setuid`	ERRNO res, UID uid
Yes	`<`	`setgid`	ERRNO res, GID gid
Yes	`<`	`getuid`	UID uid
Yes	`<`	`geteuid`	UID euid
Yes	`<`	`getgid`	GID gid
Yes	`<`	`getegid`	GID egid
Yes	`<`	`getresuid`	ERRNO res, UID ruid, UID euid, UID suid
Yes	`<`	`getresgid`	ERRNO res, GID rgid, GID egid, GID sgid
Yes	`<`	`clone`	PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, CLONE_CHILD_IN_PIDNS, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes	`<`	`fork`	PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, CLONE_CHILD_IN_PIDNS, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes	`<`	`vfork`	PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, CLONE_CHILD_IN_PIDNS, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes	`<`	`getdents`	ERRNO res, FD fd
Yes	`<`	`getdents64`	ERRNO res, FD fd
Yes	`<`	`setns`	ERRNO res, FD fd, FLAGS32 nstype: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, CLONE_CHILD_IN_PIDNS
Yes	`<`	`flock`	ERRNO res, FD fd, FLAGS32 operation: LOCK_SH, LOCK_EX, LOCK_NB, LOCK_UN, LOCK_NONE
Yes	`<`	`accept`	FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax
Yes	`<`	`semop`	ERRNO res, UINT32 nsops, UINT16 sem_num_0, INT16 sem_op_0, FLAGS16 sem_flg_0: IPC_NOWAIT, SEM_UNDO, UINT16 sem_num_1, INT16 sem_op_1, FLAGS16 sem_flg_1: IPC_NOWAIT, SEM_UNDO, INT32 semid
Yes	`<`	`semctl`	ERRNO res, INT32 semid, INT32 semnum, FLAGS16 cmd: IPC_STAT, IPC_SET, IPC_RMID, IPC_INFO, SEM_INFO, SEM_STAT, GETALL, GETNCNT, GETPID, GETVAL, GETZCNT, SETALL, SETVAL, INT32 val
Yes	`<`	`ppoll`	ERRNO res, FDLIST fds, RELTIME timeout, SIGSET sigmask
Yes	`<`	`mount`	ERRNO res, CHARBUF dev, FSPATH dir, CHARBUF type, FLAGS32 flags: RDONLY, NOSUID, NODEV, NOEXEC, SYNCHRONOUS, REMOUNT, MANDLOCK, DIRSYNC, NOATIME, NODIRATIME, BIND, MOVE, REC, SILENT, POSIXACL, UNBINDABLE, PRIVATE, SLAVE, SHARED, RELATIME, KERNMOUNT, I_VERSION, STRICTATIME, LAZYTIME, NOSEC, BORN, ACTIVE, NOUSER
Yes	`<`	`semget`	ERRNO res, INT32 key, INT32 nsems, FLAGS32 semflg: IPC_EXCL, IPC_CREAT
Yes	`<`	`access`	ERRNO res, FSPATH name, FLAGS32 mode: F_OK, R_OK, W_OK, X_OK
Yes	`<`	`chroot`	ERRNO res, FSPATH path
Yes	`<`	`setsid`	PID res
Yes	`<`	`mkdir`	ERRNO res, FSPATH path, UINT32 mode
Yes	`<`	`rmdir`	ERRNO res, FSPATH path
Yes	`<`	`unshare`	ERRNO res, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, CLONE_CHILD_IN_PIDNS
Yes	`<`	`execve`	ERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID vpgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, EXE_LOWER_LAYER, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath, PID pgid, GID gid, FSPATH filename
Yes	`<`	`setpgid`	ERRNO res, PID pid, PID pgid
Yes	`<`	`seccomp`	ERRNO res, UINT64 op, UINT64 flags
Yes	`<`	`unlink`	ERRNO res, FSPATH path
Yes	`<`	`unlinkat`	ERRNO res, FD dirfd, FSRELPATH name, FLAGS32 flags: AT_REMOVEDIR
Yes	`<`	`mkdirat`	ERRNO res, FD dirfd, FSRELPATH path, UINT32 mode
Yes	`>`	`openat`	FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode
Yes	`<`	`openat`	FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, UINT32 dev, UINT64 ino
Yes	`<`	`link`	ERRNO res, FSPATH oldpath, FSPATH newpath
Yes	`<`	`linkat`	ERRNO res, FD olddir, FSRELPATH oldpath, FD newdir, FSRELPATH newpath, FLAGS32 flags: AT_SYMLINK_FOLLOW, AT_EMPTY_PATH
Yes	`<`	`fchmodat`	ERRNO res, FD dirfd, FSRELPATH filename, MODE mode
Yes	`<`	`chmod`	ERRNO res, FSPATH filename, MODE mode
Yes	`<`	`fchmod`	ERRNO res, FD fd, MODE mode
Yes	`<`	`renameat2`	ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath, FLAGS32 flags: RENAME_NOREPLACE, RENAME_EXCHANGE, RENAME_WHITEOUT
Yes	`<`	`userfaultfd`	ERRNO res, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER
Yes	`>`	`openat2`	FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED
Yes	`<`	`openat2`	FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED, UINT32 dev, UINT64 ino
Yes	`<`	`mprotect`	ERRNO res, UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE
Yes	`<`	`execveat`	ERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID vpgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, EXE_LOWER_LAYER, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath, PID pgid, GID gid
Yes	`<`	`copy_file_range`	ERRNO res, FD fdout, UINT64 offout, FD fdin, UINT64 offin, UINT64 len
Yes	`<`	`clone3`	PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, CLONE_CHILD_IN_PIDNS, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes	`<`	`open_by_handle_at`	FD fd, FD mountfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, FSPATH path, UINT32 dev, UINT64 ino
Yes	`<`	`io_uring_setup`	ERRNO res, UINT32 entries, UINT32 sq_entries, UINT32 cq_entries, FLAGS32 flags: IORING_SETUP_IOPOLL, IORING_SETUP_SQPOLL, IORING_SQ_NEED_WAKEUP, IORING_SETUP_SQ_AFF, IORING_SETUP_CQSIZE, IORING_SETUP_CLAMP, IORING_SETUP_ATTACH_RW, IORING_SETUP_R_DISABLED, UINT32 sq_thread_cpu, UINT32 sq_thread_idle, FLAGS32 features: IORING_FEAT_SINGLE_MMAP, IORING_FEAT_NODROP, IORING_FEAT_SUBMIT_STABLE, IORING_FEAT_RW_CUR_POS, IORING_FEAT_CUR_PERSONALITY, IORING_FEAT_FAST_POLL, IORING_FEAT_POLL_32BITS, IORING_FEAT_SQPOLL_NONFIXED, IORING_FEAT_ENTER_EXT_ARG, IORING_FEAT_NATIVE_WORKERS, IORING_FEAT_RSRC_TAGS
Yes	`<`	`io_uring_enter`	ERRNO res, FD fd, UINT32 to_submit, UINT32 min_complete, FLAGS32 flags: IORING_ENTER_GETEVENTS, IORING_ENTER_SQ_WAKEUP, IORING_ENTER_SQ_WAIT, IORING_ENTER_EXT_ARG, SIGSET sig
Yes	`<`	`io_uring_register`	ERRNO res, FD fd, ENUMFLAGS16 opcode: IORING_REGISTER_BUFFERS, IORING_UNREGISTER_BUFFERS, IORING_REGISTER_FILES, IORING_UNREGISTER_FILES, IORING_REGISTER_EVENTFD, IORING_UNREGISTER_EVENTFD, IORING_REGISTER_FILES_UPDATE, IORING_REGISTER_EVENTFD_ASYNC, IORING_REGISTER_PROBE, IORING_REGISTER_PERSONALITY, IORING_UNREGISTER_PERSONALITY, IORING_REGISTER_RESTRICTIONS, IORING_REGISTER_ENABLE_RINGS, IORING_REGISTER_FILES2, IORING_REGISTER_FILES_UPDATE2, IORING_REGISTER_BUFFERS2, IORING_REGISTER_BUFFERS_UPDATE, IORING_REGISTER_IOWQ_AFF, IORING_UNREGISTER_IOWQ_AFF, IORING_REGISTER_IOWQ_MAX_WORKERS, IORING_REGISTER_RING_FDS, IORING_UNREGISTER_RING_FDS, UINT64 arg, UINT32 nr_args
Yes	`<`	`mlock`	ERRNO res, UINT64 addr, UINT64 len
Yes	`<`	`munlock`	ERRNO res, UINT64 addr, UINT64 len
Yes	`<`	`mlockall`	ERRNO res, FLAGS32 flags: MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT
Yes	`<`	`munlockall`	ERRNO res
Yes	`<`	`capset`	ERRNO res, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective
Yes	`<`	`dup2`	FD res, FD oldfd, FD newfd
Yes	`<`	`dup3`	FD res, FD oldfd, FD newfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER
Yes	`<`	`dup`	FD res, FD oldfd
Yes	`<`	`bpf`	FD fd, ENUMFLAGS32 cmd: BPF_MAP_CREATE, BPF_MAP_LOOKUP_ELEM, BPF_MAP_UPDATE_ELEM, BPF_MAP_DELETE_ELEM, BPF_MAP_GET_NEXT_KEY, BPF_PROG_LOAD, BPF_OBJ_PIN, BPF_OBJ_GET, BPF_PROG_ATTACH, BPF_PROG_DETACH, BPF_PROG_TEST_RUN, BPF_PROG_RUN, BPF_PROG_GET_NEXT_ID, BPF_MAP_GET_NEXT_ID, BPF_PROG_GET_FD_BY_ID, BPF_MAP_GET_FD_BY_ID, BPF_OBJ_GET_INFO_BY_FD, BPF_PROG_QUERY, BPF_RAW_TRACEPOINT_OPEN, BPF_BTF_LOAD, BPF_BTF_GET_FD_BY_ID, BPF_TASK_FD_QUERY, BPF_MAP_LOOKUP_AND_DELETE_ELEM, BPF_MAP_FREEZE, BPF_BTF_GET_NEXT_ID, BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, BPF_MAP_DELETE_BATCH, BPF_LINK_CREATE, BPF_LINK_UPDATE, BPF_LINK_GET_FD_BY_ID, BPF_LINK_GET_NEXT_ID, BPF_ENABLE_STATS, BPF_ITER_CREATE, BPF_LINK_DETACH, BPF_PROG_BIND_MAP
Yes	`<`	`mlock2`	ERRNO res, UINT64 addr, UINT64 len, FLAGS32 flags: MLOCK_ONFAULT
Yes	`<`	`fsconfig`	ERRNO res, FD fd, ENUMFLAGS32 cmd: FSCONFIG_SET_FLAG, FSCONFIG_SET_STRING, FSCONFIG_SET_BINARY, FSCONFIG_SET_PATH, FSCONFIG_SET_PATH_EMPTY, FSCONFIG_SET_FD, FSCONFIG_CMD_CREATE, FSCONFIG_CMD_RECONFIGURE, CHARBUF key, BYTEBUF value_bytebuf, CHARBUF value_charbuf, INT32 aux
Yes	`<`	`epoll_create`	ERRNO res, INT32 size
Yes	`<`	`epoll_create1`	ERRNO res, FLAGS32 flags: EPOLL_CLOEXEC
Yes	`<`	`chown`	ERRNO res, FSPATH path, UINT32 uid, UINT32 gid
Yes	`<`	`lchown`	ERRNO res, FSPATH path, UINT32 uid, UINT32 gid
Yes	`<`	`fchown`	ERRNO res, FD fd, UINT32 uid, UINT32 gid
Yes	`<`	`fchownat`	ERRNO res, FD dirfd, FSRELPATH pathname, UINT32 uid, UINT32 gid, FLAGS32 flags: AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH
Yes	`<`	`umount`	ERRNO res, FSPATH name
Yes	`<`	`accept4`	FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax, INT32 flags
Yes	`<`	`umount2`	ERRNO res, FSPATH name, FLAGS32 flags: FORCE, DETACH, EXPIRE, NOFOLLOW
Yes	`<`	`pipe2`	ERRNO res, FD fd1, FD fd2, UINT64 ino, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER
Yes	`<`	`inotify_init1`	FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER
Yes	`<`	`eventfd2`	FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT64 initval
Yes	`<`	`signalfd4`	FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, FD fd, UINT32 mask
Yes	`<`	`prctl`	ERRNO res, ENUMFLAGS32 option: PR_GET_DUMPABLE, PR_SET_DUMPABLE, PR_GET_KEEPCAPS, PR_SET_KEEPCAPS, PR_SET_NAME, PR_GET_NAME, PR_GET_SECCOMP, PR_SET_SECCOMP, PR_CAPBSET_READ, PR_CAPBSET_DROP, PR_GET_SECUREBITS, PR_SET_SECUREBITS, PR_MCE_KILL, PR_MCE_KILL, PR_SET_MM, PR_SET_CHILD_SUBREAPER, PR_GET_CHILD_SUBREAPER, PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS, PR_GET_TID_ADDRESS, PR_SET_THP_DISABLE, PR_GET_THP_DISABLE, PR_CAP_AMBIENT, CHARBUF arg2_str, INT64 arg2_int
Yes	`<`	`memfd_create`	FD fd, CHARBUF name, FLAGS32 flags: MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB
Yes	`<`	`pidfd_getfd`	FD fd, FD pid_fd, FD target_fd, UINT32 flags
Yes	`<`	`pidfd_open`	FD fd, PID pid, FLAGS32 flags: PIDFD_NONBLOCK
Yes	`<`	`init_module`	ERRNO res, BYTEBUF img, UINT64 length, CHARBUF uargs
Yes	`<`	`finit_module`	ERRNO res, FD fd, CHARBUF uargs, FLAGS32 flags: MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC, MODULE_INIT_COMPRESSED_FILE
Yes	`<`	`mknod`	ERRNO res, FSPATH path, MODE mode, UINT32 dev
Yes	`<`	`mknodat`	ERRNO res, FD dirfd, FSRELPATH path, MODE mode, UINT32 dev
Yes	`<`	`newfstatat`	ERRNO res, FD dirfd, FSRELPATH path, FLAGS32 flags: AT_EMPTY_PATH, AT_NO_AUTOMOUNT, AT_SYMLINK_NOFOLLOW
Yes	`<`	`process_vm_readv`	INT64 res, PID pid, BYTEBUF data
Yes	`<`	`process_vm_writev`	INT64 res, PID pid, BYTEBUF data
Yes	`<`	`delete_module`	ERRNO res, CHARBUF name, FLAGS32 flags: O_NONBLOCK, O_TRUNC
Yes	`<`	`setreuid`	ERRNO res, UID ruid, UID euid
Yes	`<`	`setregid`	ERRNO res, UID rgid, UID egid
Yes	`>`	`adjtimex`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`adjtimex`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`exit`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`exit`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sethostname`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sethostname`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getsid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getsid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fstatfs`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fstatfs`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pivot_root`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pivot_root`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`oldstat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`oldstat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`umask`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`umask`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`madvise`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`madvise`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`statfs64`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`statfs64`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`iopl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`iopl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`swapon`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`swapon`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`utime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`utime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getpid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getpid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setdomainname`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setdomainname`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`semtimedop`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`semtimedop`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mq_notify`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mq_notify`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`nfsservctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`nfsservctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pkey_mprotect`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pkey_mprotect`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fgetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fgetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sysinfo`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sysinfo`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`uselib`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`uselib`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`olduname`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`olduname`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`set_mempolicy`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`set_mempolicy`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getppid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getppid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_yield`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_yield`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getrusage`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getrusage`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sigsuspend`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sigsuspend`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`riscv_hwprobe`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`riscv_hwprobe`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`bdflush`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`bdflush`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`get_kernel_syms`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`get_kernel_syms`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pause`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pause`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getpmsg`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getpmsg`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`clock_gettime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`clock_gettime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mq_getsetattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mq_getsetattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`spu_run`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`spu_run`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`personality`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`personality`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`request_key`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`request_key`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`readlink`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`readlink`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`times`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`times`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`reboot`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`reboot`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`syslog`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`syslog`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ipc`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ipc`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`create_module`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`create_module`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`listxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`listxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setpriority`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setpriority`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sigreturn`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sigreturn`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setgroups`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setgroups`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`preadv2`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`preadv2`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setitimer`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setitimer`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`shmat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`shmat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getitimer`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getitimer`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`removexattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`removexattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`msgget`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`msgget`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`spu_create`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`spu_create`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`capget`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`capget`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigsuspend`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigsuspend`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mseal`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mseal`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fanotify_init`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fanotify_init`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`readdir`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`readdir`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mq_timedreceive`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mq_timedreceive`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`nice`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`nice`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fsopen`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fsopen`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigpending`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigpending`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sysfs`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sysfs`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`acct`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`acct`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setfsgid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setfsgid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sync`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sync`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`clock_adjtime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`clock_adjtime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`io_getevents`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`io_getevents`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`query_module`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`query_module`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`remap_file_pages`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`remap_file_pages`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigprocmask`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigprocmask`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mincore`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mincore`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getpgid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getpgid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`msgsnd`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`msgsnd`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_getparam`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_getparam`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getgroups`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getgroups`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ustat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ustat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`uname`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`uname`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`epoll_ctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`epoll_ctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lgetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lgetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`_sysctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`_sysctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigtimedwait`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigtimedwait`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`flistxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`flistxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pkey_alloc`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pkey_alloc`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`time`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`time`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`kcmp`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`kcmp`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`epoll_pwait`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`epoll_pwait`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`oldlstat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`oldlstat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_setscheduler`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_setscheduler`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`statfs`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`statfs`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fdatasync`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fdatasync`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`set_robust_list`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`set_robust_list`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`swapoff`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`swapoff`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`quotactl_fd`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`quotactl_fd`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`exit_group`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`exit_group`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`listmount`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`listmount`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timerfd_settime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timerfd_settime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_getscheduler`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_getscheduler`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_get_priority_min`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_get_priority_min`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ftruncate`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ftruncate`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pkey_free`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pkey_free`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_rr_get_interval`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_rr_get_interval`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`open_tree`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`open_tree`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`idle`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`idle`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mremap`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mremap`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigaction`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigaction`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`stime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`stime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_getattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_getattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigqueueinfo`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigqueueinfo`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sync_file_range`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sync_file_range`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mq_unlink`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mq_unlink`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`alarm`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`alarm`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`inotify_rm_watch`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`inotify_rm_watch`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lsetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lsetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timer_delete`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timer_delete`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`msync`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`msync`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timer_settime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timer_settime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sigprocmask`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sigprocmask`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lremovexattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lremovexattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fremovexattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fremovexattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_setaffinity`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_setaffinity`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fsetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fsetxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`settimeofday`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`settimeofday`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`gettimeofday`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`gettimeofday`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`io_setup`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`io_setup`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`llistxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`llistxattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fsync`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fsync`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pidfd_send_signal`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pidfd_send_signal`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getrandom`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getrandom`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`s390_sthyi`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`s390_sthyi`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`io_destroy`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`io_destroy`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sigaltstack`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sigaltstack`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`riscv_flush_icache`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`riscv_flush_icache`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mount_setattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mount_setattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getpgrp`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getpgrp`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`vhangup`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`vhangup`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`set_tid_address`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`set_tid_address`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timer_create`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timer_create`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timer_gettime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timer_gettime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timer_getoverrun`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timer_getoverrun`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`clock_settime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`clock_settime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`clock_getres`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`clock_getres`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`utimes`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`utimes`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`vm86`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`vm86`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lsm_set_self_attr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lsm_set_self_attr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`clock_nanosleep`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`clock_nanosleep`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`futimesat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`futimesat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`signal`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`signal`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mq_open`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mq_open`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`keyctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`keyctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ioprio_set`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ioprio_set`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`landlock_add_rule`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`landlock_add_rule`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`add_key`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`add_key`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`set_thread_area`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`set_thread_area`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ioprio_get`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ioprio_get`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sync_file_range2`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sync_file_range2`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ioperm`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ioperm`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sigaction`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sigaction`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`inotify_add_watch`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`inotify_add_watch`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fallocate`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fallocate`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`get_thread_area`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`get_thread_area`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`readlinkat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`readlinkat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`name_to_handle_at`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`name_to_handle_at`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`perf_event_open`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`perf_event_open`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`kexec_load`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`kexec_load`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`truncate`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`truncate`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`faccessat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`faccessat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mq_timedsend`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mq_timedsend`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`restart_syscall`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`restart_syscall`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`map_shadow_stack`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`map_shadow_stack`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pselect6`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pselect6`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`epoll_ctl_old`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`epoll_ctl_old`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`get_robust_list`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`get_robust_list`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`tee`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`tee`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`vmsplice`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`vmsplice`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getcpu`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getcpu`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`utimensat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`utimensat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rseq`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rseq`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timerfd_gettime`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timerfd_gettime`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`syncfs`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`syncfs`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`msgctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`msgctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`io_submit`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`io_submit`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`oldolduname`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`oldolduname`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`shmdt`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`shmdt`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_getaffinity`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_getaffinity`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fstatat64`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fstatat64`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`socketcall`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`socketcall`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`waitid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`waitid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sgetmask`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sgetmask`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`io_cancel`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`io_cancel`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_setparam`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_setparam`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`cachestat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`cachestat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_setattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_setattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`ssetmask`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`ssetmask`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`_newselect`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`_newselect`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setfsuid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setfsuid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sigpending`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sigpending`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`wait4`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`wait4`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`process_mrelease`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`process_mrelease`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`waitpid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`waitpid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`arch_prctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`arch_prctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_sigreturn`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_sigreturn`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fadvise64`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fadvise64`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`msgrcv`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`msgrcv`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`move_mount`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`move_mount`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lookup_dcookie`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lookup_dcookie`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fspick`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fspick`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`shmget`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`shmget`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fsmount`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fsmount`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`epoll_pwait2`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`epoll_pwait2`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`move_pages`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`move_pages`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`shmctl`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`shmctl`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`memfd_secret`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`memfd_secret`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`landlock_restrict_self`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`landlock_restrict_self`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sched_get_priority_max`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sched_get_priority_max`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`sys_debug_setcontext`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`sys_debug_setcontext`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`kexec_file_load`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`kexec_file_load`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`process_madvise`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`process_madvise`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`landlock_create_ruleset`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`landlock_create_ruleset`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rt_tgsigqueueinfo`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rt_tgsigqueueinfo`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`migrate_pages`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`migrate_pages`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fstatfs64`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fstatfs64`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pwritev2`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pwritev2`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`mbind`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`mbind`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`modify_ldt`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`modify_ldt`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`gettid`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`gettid`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`statx`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`statx`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getpriority`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getpriority`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`io_pgetevents`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`io_pgetevents`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`listxattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`listxattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`set_mempolicy_home_node`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`set_mempolicy_home_node`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`readahead`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`readahead`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`futex_waitv`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`futex_waitv`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`epoll_wait_old`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`epoll_wait_old`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`faccessat2`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`faccessat2`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`get_mempolicy`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`get_mempolicy`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`membarrier`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`membarrier`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pciconfig_iobase`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pciconfig_iobase`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`close_range`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`close_range`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fanotify_mark`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fanotify_mark`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`open_tree_attr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`open_tree_attr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`timerfd`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`timerfd`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`s390_pci_mmio_read`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`s390_pci_mmio_read`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`s390_pci_mmio_write`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`s390_pci_mmio_write`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`s390_runtime_instr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`s390_runtime_instr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`s390_guarded_storage`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`s390_guarded_storage`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`fchmodat2`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`fchmodat2`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`futex_wake`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`futex_wake`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`futex_requeue`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`futex_requeue`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`futex_wait`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`futex_wait`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`switch_endian`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`switch_endian`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`multiplexer`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`multiplexer`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`oldfstat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`oldfstat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lsm_get_self_attr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lsm_get_self_attr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`swapcontext`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`swapcontext`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pciconfig_write`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pciconfig_write`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`rtas`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`rtas`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`pciconfig_read`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`pciconfig_read`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`subpage_prot`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`subpage_prot`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`statmount`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`statmount`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`lsm_list_modules`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`lsm_list_modules`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`uretprobe`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`uretprobe`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`removexattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`removexattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`getxattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`getxattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`setxattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`setxattrat`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`file_getattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`file_getattr`	SYSCALLID ID, UINT16 nativeID
Yes	`>`	`file_setattr`	SYSCALLID ID, UINT16 nativeID
Yes	`<`	`file_setattr`	SYSCALLID ID, UINT16 nativeID

Tracepoint events

Default	Dir	Name	Params
Yes	`>`	`switch`	PID next, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap
Yes	`>`	`procexit`	ERRNO status, ERRNO ret, SIGTYPE sig, UINT8 core, PID reaper_tid
Yes	`>`	`signaldeliver`	PID spid, PID dpid, SIGTYPE sig
Yes	`>`	`page_fault`	UINT64 addr, UINT64 ip, FLAGS32 error: PROTECTION_VIOLATION, PAGE_NOT_PRESENT, WRITE_ACCESS, READ_ACCESS, USER_FAULT, SUPERVISOR_FAULT, RESERVED_PAGE, INSTRUCTION_FETCH

Plugin events

Default	Dir	Name	Params
Yes	`>`	`pluginevent`	UINT32 plugin_id, BYTEBUF event_data

Metaevents

Default	Dir	Name	Params
Yes	`>`	`drop`	UINT32 ratio
Yes	`<`	`drop`	UINT32 ratio
Yes	`>`	`scapevent`	UINT32 event_type, UINT64 event_data
Yes	`>`	`procinfo`	UINT64 cpu_usr, UINT64 cpu_sys
Yes	`>`	`cpu_hotplug`	UINT32 cpu, UINT32 action
Yes	`>`	`notification`	CHARBUF id, CHARBUF desc
Yes	`>`	`infra`	CHARBUF source, CHARBUF name, CHARBUF description, CHARBUF scope
Yes	`>`	`container`	CHARBUF json
Yes	`>`	`useradded`	UINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id
Yes	`>`	`userdeleted`	UINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id
Yes	`>`	`groupadded`	UINT32 gid, CHARBUF name, CHARBUF container_id
Yes	`>`	`groupdeleted`	UINT32 gid, CHARBUF name, CHARBUF container_id
Yes	`>`	`asyncevent`	UINT32 plugin_id, CHARBUF name, BYTEBUF data

Docs: Supported Fields for Conditions and Outputs

Mon, 01 Jan 0001 00:00:00 +0000

Here are the fields supported by Falco. These fields can be used in the condition key of a Falco rule and well as the output key. Any fields included in the output key of a rule will also be included in the alert's output_fields object when json_output is set to true.

You can also see this set of fields via falco --list=<source>, with <source> being one of the Falco event sources.

System Calls (source `syscall`)

syscall event source fields are provided by the Falco Drivers. See the supported events documentation to learn about all the available event types. The field evt.arg, evt.args and evt.rawarg is used to access arguments for each event. For example, in order to access the target arg of a symlinkat exit event you can use evt.arg.target.

# System Kernel Fields
$ falco --list=syscall

Field Class: evt

These fields can be used for all event types

Name	Type	Description
`evt.num`	UINT64	event number.
`evt.time`	CHARBUF	event timestamp as a time string that includes the nanosecond part.
`evt.time.s`	CHARBUF	event timestamp as a time string with no nanoseconds.
`evt.time.iso8601`	CHARBUF	event timestamp in ISO 8601 format, including nanoseconds and time zone offset (in UTC).
`evt.datetime`	CHARBUF	event timestamp as a time string that includes the date.
`evt.datetime.s`	CHARBUF	event timestamp as a datetime string with no nanoseconds.
`evt.rawtime`	ABSTIME	absolute event timestamp, i.e. nanoseconds from epoch.
`evt.rawtime.s`	ABSTIME	integer part of the event timestamp (e.g. seconds since epoch).
`evt.rawtime.ns`	ABSTIME	fractional part of the absolute event timestamp.
`evt.reltime`	RELTIME	number of nanoseconds from the beginning of the capture.
`evt.reltime.s`	RELTIME	number of seconds from the beginning of the capture.
`evt.reltime.ns`	RELTIME	fractional part (in ns) of the time from the beginning of the capture.
`evt.pluginname`	CHARBUF	if the event comes from a plugin-defined event source, the name of the plugin that generated it. The plugin must be currently loaded.
`evt.plugininfo`	CHARBUF	if the event comes from a plugin-defined event source, a summary of the event as formatted by the plugin. The plugin must be currently loaded.
`evt.source`	CHARBUF	the name of the source that produced the event.
`evt.is_async`	BOOL	'true' for asynchronous events, 'false' otherwise.
`evt.asynctype`	CHARBUF	If the event is asynchronous, the type of the event (e.g. 'container').
`evt.hostname`	CHARBUF	The hostname of the underlying host can be customized by setting an environment variable (e.g. FALCO_HOSTNAME for the Falco agent). This is valuable in Kubernetes setups, where the hostname can match the pod name particularly in DaemonSet deployments. To achieve this, assign Kubernetes' spec.nodeName to the environment variable. Notably, spec.nodeName generally includes the cluster name.

Field Class: evt (for system calls)

Event fields applicable to syscall events. Note that for most events you can access the individual arguments/parameters of each syscall via evt.arg, e.g. evt.arg.filename.

Name	Type	Description
`evt.deltatime`	RELTIME	delta between this event and the previous event, in nanoseconds.
`evt.deltatime.s`	RELTIME	integer part of the delta between this event and the previous event.
`evt.deltatime.ns`	RELTIME	fractional part of the delta between this event and the previous event.
`evt.type`	CHARBUF	The name of the event (e.g. 'open').
`evt.type.is`	UINT32	allows one to specify an event type, and returns 1 for events that are of that type. For example, evt.type.is.open returns 1 for open events, 0 for any other event.
`syscall.type`	CHARBUF	For system call events, the name of the system call (e.g. 'open'). Unset for other events (e.g. switch or internal events). Use this field instead of evt.type if you need to make sure that the filtered/printed value is actually a system call.
`evt.category`	CHARBUF	The event category. Example values are 'file' (for file operations like open and close), 'net' (for network operations like socket and bind), memory (for things like brk or mmap), and so on.
`evt.cpu`	INT16	number of the CPU where this event happened.
`evt.args`	CHARBUF	all the event arguments, aggregated into a single string.
`evt.arg`	CHARBUF	one of the event arguments specified by name or by number. Some events (e.g. return codes or FDs) will be converted into a text representation when possible. E.g. 'evt.arg.fd' or 'evt.arg[0]'.
`evt.rawarg`	DYNAMIC	one of the event arguments specified by name. E.g. 'evt.rawarg.fd'.
`evt.info`	CHARBUF	Currently, this field returns the same value as 'evt.args'.
`evt.buffer`	BYTEBUF	the binary data buffer for events that have one, like read(), recvfrom(), etc. Use this field in filters with 'contains' to search into I/O data buffers.
`evt.buflen`	UINT64	the length of the binary data buffer for events that have one, like read(), recvfrom(), etc.
`evt.res`	CHARBUF	event return value, as a string. If the event failed, the result is an error code string (e.g. 'ENOENT'), otherwise the result is the string 'SUCCESS'.
`evt.rawres`	INT64	event return value, as a number (e.g. -2). Useful for range comparisons.
`evt.failed`	BOOL	'true' for events that returned an error status.
`evt.is_io`	BOOL	'true' for events that read or write to FDs, like read(), send, recvfrom(), etc.
`evt.is_io_read`	BOOL	'true' for events that read from FDs, like read(), recv(), recvfrom(), etc.
`evt.is_io_write`	BOOL	'true' for events that write to FDs, like write(), send(), etc.
`evt.io_dir`	CHARBUF	'r' for events that read from FDs, like read(); 'w' for events that write to FDs, like write().
`evt.is_wait`	BOOL	'true' for events that make the thread wait, e.g. sleep(), select(), poll().
`evt.is_syslog`	BOOL	'true' for events that are writes to /dev/log.
`evt.count`	UINT32	This filter field always returns 1.
`evt.count.error`	UINT32	This filter field returns 1 for events that returned with an error.
`evt.count.error.file`	UINT32	This filter field returns 1 for events that returned with an error and are related to file I/O.
`evt.count.error.net`	UINT32	This filter field returns 1 for events that returned with an error and are related to network I/O.
`evt.count.error.memory`	UINT32	This filter field returns 1 for events that returned with an error and are related to memory allocation.
`evt.count.error.other`	UINT32	This filter field returns 1 for events that returned with an error and are related to none of the previous categories.
`evt.count.exit`	UINT32	This filter field returns 1 for exit events.
`evt.around`	UINT64	Accepts the event if it's around the specified time interval. The syntax is evt.around[T]=D, where T is the value returned by %evt.rawtime for the event and D is a delta in milliseconds. For example, evt.around[1404996934793590564]=1000 will return the events with timestamp with one second before the timestamp and one second after it, for a total of two seconds of capture.
`evt.abspath`	CHARBUF	Absolute path calculated from dirfd and name during syscalls like renameat and symlinkat. Use 'evt.abspath.src' or 'evt.abspath.dst' for syscalls that support multiple paths.
`evt.is_open_read`	BOOL	'true' for open/openat/openat2/open_by_handle_at events where the path was opened for reading
`evt.is_open_write`	BOOL	'true' for open/openat/openat2/open_by_handle_at events where the path was opened for writing
`evt.is_open_exec`	BOOL	'true' for open/openat/openat2/open_by_handle_at or creat events where a file is created with execute permissions
`evt.is_open_create`	BOOL	'true' for for open/openat/openat2/open_by_handle_at events where a file is created.

Field Class: process

Additional information about the process and thread executing the syscall event.

Name	Type	Description
`proc.exe`	CHARBUF	The first command-line argument (i.e., argv[0]), typically the executable name or a custom string as specified by the user. It is primarily obtained from syscall arguments, truncated after 4096 bytes, or, as a fallback, by reading /proc/PID/cmdline, in which case it may be truncated after 1024 bytes. This field may differ from the last component of proc.exepath, reflecting how command invocation and execution paths can vary.
`proc.pexe`	CHARBUF	The proc.exe (first command line argument argv[0]) of the parent process.
`proc.aexe`	CHARBUF	The proc.exe (first command line argument argv[0]) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aexe[1] retrieves the proc.exe of the parent process, proc.aexe[2] retrieves the proc.exe of the grandparent process, and so on. The current process's proc.exe line can be obtained using proc.aexe[0]. When used without any arguments, proc.aexe is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.aexe endswith java` to match any process ancestor whose proc.exe ends with the term `java`.
`proc.exepath`	CHARBUF	The full executable path of a process, resolving to the canonical path for symlinks. This is primarily obtained from the kernel, or as a fallback, by reading /proc/PID/exe (in the latter case, the path is truncated after 1024 bytes). For eBPF drivers, due to verifier limits, path components may be truncated to 24 for legacy eBPF on kernel <5.2, 48 for legacy eBPF on kernel >=5.2, or 96 for modern eBPF.
`proc.pexepath`	CHARBUF	The proc.exepath (full executable path) of the parent process.
`proc.aexepath`	CHARBUF	The proc.exepath (full executable path) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aexepath[1] retrieves the proc.exepath of the parent process, proc.aexepath[2] retrieves the proc.exepath of the grandparent process, and so on. The current process's proc.exepath line can be obtained using proc.aexepath[0]. When used without any arguments, proc.aexepath is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.aexepath endswith java` to match any process ancestor whose path ends with the term `java`.
`proc.name`	CHARBUF	The process name (truncated after 16 characters) generating the event (task->comm). Truncation is determined by kernel settings and not by Falco. This field is collected from the syscalls args or, as a fallback, extracted from /proc/PID/comm. The name of the process and the name of the executable file on disk (if applicable) can be different if a process is given a custom name which is often the case for example for java applications.
`proc.pname`	CHARBUF	The proc.name (truncated after 16 characters) of the parent process.
`proc.aname`	CHARBUF	The proc.name (truncated after 16 characters) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aname[1] retrieves the proc.name of the parent process, proc.aname[2] retrieves the proc.name of the grandparent process, and so on. The current process's proc.name line can be obtained using proc.aname[0]. When used without any arguments, proc.aname is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.aname=bash` to match any process ancestor whose name is `bash`.
`proc.args`	CHARBUF	The arguments passed on the command line when starting the process generating the event excluding argv[0] (truncated after 4096 bytes). This field is collected from the system call arguments, or as a fallback, extracted from /proc/PID/cmdline, can be accessed by specifying proc.args[INDEX], e.g., proc.args[0] or proc.args[1]. The indexing is zero-based, meaning proc.args[0] refers to the first command-line argument passed, rather than argv[0].
`proc.aargs`	CHARBUF	The arguments passed on the command line when starting the process generating the event for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aargs[1] retrieves the arguments passed on the command line of the parent process, proc.aargs[2] retrieves the proc.args of the grandparent process, and so on. The current process's arguments passed on the command line can be obtained using proc.aargs[0]. When used without any arguments, proc.aargs is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.aargs contains base64` to match any process ancestor whose arguments passed on the command line contains the term base64.
`proc.cmdline`	CHARBUF	The concatenation of `proc.name + proc.args` (truncated after 4096 bytes) when starting the process generating the event.
`proc.pcmdline`	CHARBUF	The proc.cmdline (full command line (proc.name + proc.args)) of the parent process.
`proc.acmdline`	CHARBUF	The full command line (proc.name + proc.args) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.acmdline[1] retrieves the full command line of the parent process, proc.acmdline[2] retrieves the proc.cmdline of the grandparent process, and so on. The current process's full command line can be obtained using proc.acmdline[0]. When used without any arguments, proc.acmdline is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.acmdline contains base64` to match any process ancestor whose command line contains the term base64.
`proc.cmdnargs`	UINT64	The number of command line args (proc.args).
`proc.cmdlenargs`	UINT64	The total count of characters / length of the command line args (proc.args) combined excluding whitespaces between args.
`proc.exeline`	CHARBUF	The full command line, with exe as first argument (proc.exe + proc.args) when starting the process generating the event.
`proc.env`	CHARBUF	The environment variables of the process generating the event as concatenated string 'ENV_NAME=value ENV_NAME1=value1'. Can also be used to extract the value of a known env variable, e.g. proc.env[ENV_NAME].
`proc.aenv`	CHARBUF	[EXPERIMENTAL] This field can be used in three flavors: (1) as a filter checking all parents, e.g. 'proc.aenv contains xyz', which is similar to the familiar 'proc.aname contains xyz' approach, (2) checking the `proc.env` of a specified level of the parent, e.g. 'proc.aenv[2]', which is similar to the familiar 'proc.aname[2]' approach, or (3) checking the first matched value of a known ENV_NAME in the parent lineage, such as 'proc.aenv[ENV_NAME]' (across a max of 20 ancestor levels). This field may be deprecated or undergo breaking changes in future releases. Please use it with caution.
`proc.cwd`	CHARBUF	The current working directory of the event.
`proc.loginshellid`	INT64	The pid of the oldest shell among the ancestors of the current process, if there is one. This field can be used to separate different user sessions.
`proc.tty`	UINT32	The controlling terminal of the process. 0 for processes without a terminal.
`proc.pid`	INT64	The id of the process generating the event.
`proc.ppid`	INT64	The pid of the parent of the process generating the event.
`proc.apid`	INT64	The pid for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.apid[1] retrieves the pid of the parent process, proc.apid[2] retrieves the pid of the grandparent process, and so on. The current process's pid can be obtained using proc.apid[0]. When used without any arguments, proc.apid is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.apid=1337` to match any process ancestor whose pid is equal to 1337.
`proc.vpid`	INT64	The id of the process generating the event as seen from its current PID namespace.
`proc.pvpid`	INT64	The id of the parent process generating the event as seen from its current PID namespace.
`proc.sid`	INT64	The session id of the process generating the event.
`proc.sname`	CHARBUF	The name of the current process's session leader. This is either the process with pid=proc.sid or the eldest ancestor that has the same sid as the current process.
`proc.sid.exe`	CHARBUF	The first command line argument argv[0] (usually the executable name or a custom one) of the current process's session leader. This is either the process with pid=proc.sid or the eldest ancestor that has the same sid as the current process.
`proc.sid.exepath`	CHARBUF	The full executable path of the current process's session leader. This is either the process with pid=proc.sid or the eldest ancestor that has the same sid as the current process.
`proc.vpgid`	INT64	The process group id of the process generating the event, as seen from its current PID namespace.
`proc.vpgid.name`	CHARBUF	The name of the current process's process group leader. This is either the process with proc.vpgid == proc.vpid or the eldest ancestor that has the same vpgid as the current process. The description of `proc.is_vpgid_leader` offers additional insights.
`proc.vpgid.exe`	CHARBUF	The first command line argument argv[0] (usually the executable name or a custom one) of the current process's process group leader. This is either the process with proc.vpgid == proc.vpid or the eldest ancestor that has the same vpgid as the current process. The description of `proc.is_vpgid_leader` offers additional insights.
`proc.vpgid.exepath`	CHARBUF	The full executable path of the current process's process group leader. This is either the process with proc.vpgid == proc.vpid or the eldest ancestor that has the same vpgid as the current process. The description of `proc.is_vpgid_leader` offers additional insights.
`proc.pgid`	INT64	The process group id of the process generating the event, as seen from host PID namespace.
`proc.pgid.name`	CHARBUF	The name of the current process's process group leader. This is either the process with proc.pgid == proc.pid or the eldest ancestor that has the same pgid as the current process. The description of `proc.is_pgid_leader` offers additional insights.
`proc.pgid.exe`	CHARBUF	The first command line argument argv[0] (usually the executable name or a custom one) of the current process's process group leader. This is either the process with proc.pgid == proc.pid or the eldest ancestor that has the same pgid as the current process. The description of `proc.is_pgid_leader` offers additional insights.
`proc.pgid.exepath`	CHARBUF	The full executable path of the current process's process group leader. This is either the process with proc.pgid == proc.pid or the eldest ancestor that has the same pgid as the current process. The description of `proc.is_pgid_leader` offers additional insights.
`proc.duration`	RELTIME	Number of nanoseconds since the process started.
`proc.ppid.duration`	RELTIME	Number of nanoseconds since the parent process started.
`proc.pid.ts`	RELTIME	Start of process as epoch timestamp in nanoseconds.
`proc.ppid.ts`	RELTIME	Start of parent process as epoch timestamp in nanoseconds.
`proc.is_exe_writable`	BOOL	'true' if this process' executable file is writable by the same user that spawned the process.
`proc.is_exe_upper_layer`	BOOL	'true' if this process' executable file is in upper layer in overlayfs. This field value can only be trusted if the underlying kernel version is greater or equal than 3.18.0, since overlayfs was introduced at that time.
`proc.is_exe_lower_layer`	BOOL	'true' if this process' executable file is in lower layer in overlayfs. This field value can only be trusted if the underlying kernel version is greater or equal than 3.18.0, since overlayfs was introduced at that time.
`proc.is_exe_from_memfd`	BOOL	'true' if the executable file of the current process is an anonymous file created using memfd_create() and is being executed by referencing its file descriptor (fd). This type of file exists only in memory and not on disk. Relevant to detect malicious in-memory code injection. Requires kernel version greater or equal to 3.17.0.
`proc.is_sid_leader`	BOOL	'true' if this process is the leader of the process session, proc.sid == proc.vpid. For host processes vpid reflects pid.
`proc.is_vpgid_leader`	BOOL	'true' if this process is the leader of the virtual process group, proc.vpgid == proc.vpid. For host processes vpgid and vpid reflect pgid and pid. Can help to distinguish if the process was 'directly' executed for instance in a tty (similar to bash history logging, `is_vpgid_leader` would be 'true') or executed as descendent process in the same process group which for example is the case when subprocesses are spawned from a script (`is_vpgid_leader` would be 'false').
`proc.is_pgid_leader`	BOOL	'true' if this process is the leader of the process group, proc.pgid == proc.pid. Can help to distinguish if the process was 'directly' executed for instance in a tty (similar to bash history logging, `is_pgid_leader` would be 'true') or executed as descendent process in the same process group which for example is the case when subprocesses are spawned from a script (`is_pgid_leader` would be 'false').
`proc.exe_ino`	INT64	The inode number of the executable file on disk. Can be correlated with fd.ino.
`proc.exe_ino.ctime`	ABSTIME	Last status change time of executable file (inode->ctime) as epoch timestamp in nanoseconds. Time is changed by writing or by setting inode information e.g. owner, group, link count, mode etc.
`proc.exe_ino.mtime`	ABSTIME	Last modification time of executable file (inode->mtime) as epoch timestamp in nanoseconds. Time is changed by file modifications, e.g. by mknod, truncate, utime, write of more than zero bytes etc. For tracking changes in owner, group, link count or mode, use proc.exe_ino.ctime instead.
`proc.exe_ino.ctime_duration_proc_start`	ABSTIME	Number of nanoseconds between modifying status of executable image and spawning a new process using the changed executable image.
`proc.exe_ino.ctime_duration_pidns_start`	ABSTIME	Number of nanoseconds between PID namespace start ts and ctime exe file if PID namespace start predates ctime.
`proc.pidns_init_start_ts`	UINT64	Start of PID namespace (container or non container pid namespace) as epoch timestamp in nanoseconds.
`thread.cap_permitted`	CHARBUF	The permitted capabilities set
`thread.cap_inheritable`	CHARBUF	The inheritable capabilities set
`thread.cap_effective`	CHARBUF	The effective capabilities set
`proc.fdopencount`	UINT64	Number of open FDs for the process
`proc.fdlimit`	INT64	Maximum number of FDs the process can open.
`proc.fdusage`	DOUBLE	The ratio between open FDs and maximum available FDs for the process.
`proc.vmsize`	UINT64	Total virtual memory for the process (as kb).
`proc.vmrss`	UINT64	Resident non-swapped memory for the process (as kb).
`proc.vmswap`	UINT64	Swapped memory for the process (as kb).
`thread.pfmajor`	UINT64	Number of major page faults since thread start.
`thread.pfminor`	UINT64	Number of minor page faults since thread start.
`thread.tid`	INT64	The id of the thread generating the event.
`thread.ismain`	BOOL	'true' if the thread generating the event is the main one in the process.
`thread.vtid`	INT64	The id of the thread generating the event as seen from its current PID namespace.
`thread.exectime`	RELTIME	CPU time spent by the last scheduled thread, in nanoseconds. Exported by switch events only.
`thread.totexectime`	RELTIME	Total CPU time, in nanoseconds since the beginning of the capture, for the current thread. Exported by switch events only.
`thread.cgroups`	CHARBUF	All cgroups the thread belongs to, aggregated into a single string.
`thread.cgroup`	CHARBUF	The cgroup the thread belongs to, for a specific subsystem. e.g. thread.cgroup.cpuacct.
`proc.nthreads`	UINT64	The number of alive threads that the process generating the event currently has, including the leader thread. Please note that the leader thread may not be here, in that case 'proc.nthreads' and 'proc.nchilds' are equal
`proc.nchilds`	UINT64	The number of alive not leader threads that the process generating the event currently has. This excludes the leader thread.
`thread.cpu`	DOUBLE	The CPU consumed by the thread in the last second.
`thread.cpu.user`	DOUBLE	The user CPU consumed by the thread in the last second.
`thread.cpu.system`	DOUBLE	The system CPU consumed by the thread in the last second.
`thread.vmsize`	UINT64	For the process main thread, this is the total virtual memory for the process (as kb). For the other threads, this field is zero.
`thread.vmrss`	UINT64	For the process main thread, this is the resident non-swapped memory for the process (as kb). For the other threads, this field is zero.
`proc.stdin.type`	CHARBUF	The type of file descriptor 0, corresponding to stdin, of the process generating the event.
`proc.stdout.type`	CHARBUF	The type of file descriptor 1, corresponding to stdout, of the process generating the event.
`proc.stderr.type`	CHARBUF	The type of file descriptor 2, corresponding to stderr, of the process generating the event.
`proc.stdin.name`	CHARBUF	The name of the file descriptor 0, corresponding to stdin, of the process generating the event.
`proc.stdout.name`	CHARBUF	The name of the file descriptor 1, corresponding to stdout, of the process generating the event.
`proc.stderr.name`	CHARBUF	The name of the file descriptor 2, corresponding to stderr, of the process generating the event.

Field Class: user

Information about the user executing the specific event.

Name	Type	Description
`user.uid`	UINT32	user ID.
`user.name`	CHARBUF	user name.
`user.homedir`	CHARBUF	home directory of the user.
`user.shell`	CHARBUF	user's shell.
`user.loginuid`	INT64	audit user id (auid), internally the loginuid is of type `uint32_t`. However, if an invalid uid corresponding to UINT32_MAX is encountered, it is returned as -1 to support familiar filtering conditions.
`user.loginname`	CHARBUF	audit user name (auid).

Field Class: group

Information about the user group.

Name	Type	Description
`group.gid`	UINT32	group ID.
`group.name`	CHARBUF	group name.

Field Class: fd

Every syscall that has a file descriptor in its arguments has these fields set with information related to the file.

Name	Type	Description
`fd.num`	INT64	the unique number identifying the file descriptor.
`fd.type`	CHARBUF	type of FD. Can be 'file', 'directory', 'ipv4', 'ipv6', 'unix', 'pipe', 'event', 'signalfd', 'eventpoll', 'inotify' 'signalfd' or 'memfd'.
`fd.typechar`	CHARBUF	type of FD as a single character. Can be 'f' for file, 4 for IPv4 socket, 6 for IPv6 socket, 'u' for unix socket, p for pipe, 'e' for eventfd, 's' for signalfd, 'l' for eventpoll, 'i' for inotify, 'b' for bpf, 'u' for userfaultd, 'r' for io_uring, 'm' for memfd ,'o' for unknown.
`fd.name`	CHARBUF	FD full name. If the fd is a file, this field contains the full path. If the FD is a socket, this field contain the connection tuple.
`fd.directory`	CHARBUF	If the fd is a file, the directory that contains it.
`fd.filename`	CHARBUF	If the fd is a file, the filename without the path.
`fd.ip`	IPADDR	matches the ip address (client or server) of the fd.
`fd.cip`	IPADDR	client IP address.
`fd.sip`	IPADDR	server IP address.
`fd.lip`	IPADDR	local IP address.
`fd.rip`	IPADDR	remote IP address.
`fd.port`	PORT	matches the port (either client or server) of the fd.
`fd.cport`	PORT	for TCP/UDP FDs, the client port.
`fd.sport`	PORT	for TCP/UDP FDs, server port.
`fd.lport`	PORT	for TCP/UDP FDs, the local port.
`fd.rport`	PORT	for TCP/UDP FDs, the remote port.
`fd.l4proto`	CHARBUF	the IP protocol of a socket. Can be 'tcp', 'udp', 'icmp' or 'raw'.
`fd.sockfamily`	CHARBUF	the socket family for socket events. Can be 'ip' or 'unix'.
`fd.is_server`	BOOL	'true' if the process owning this FD is the server endpoint in the connection.
`fd.uid`	CHARBUF	a unique identifier for the FD, created by chaining the FD number and the thread ID.
`fd.containername`	CHARBUF	chaining of the container ID and the FD name. Useful when trying to identify which container an FD belongs to.
`fd.containerdirectory`	CHARBUF	chaining of the container ID and the directory name. Useful when trying to identify which container a directory belongs to.
`fd.proto`	PORT	matches the protocol (either client or server) of the fd.
`fd.cproto`	CHARBUF	for TCP/UDP FDs, the client protocol.
`fd.sproto`	CHARBUF	for TCP/UDP FDs, server protocol.
`fd.lproto`	CHARBUF	for TCP/UDP FDs, the local protocol.
`fd.rproto`	CHARBUF	for TCP/UDP FDs, the remote protocol.
`fd.net`	IPNET	matches the IP network (client or server) of the fd.
`fd.cnet`	IPNET	matches the client IP network of the fd.
`fd.snet`	IPNET	matches the server IP network of the fd.
`fd.lnet`	IPNET	matches the local IP network of the fd.
`fd.rnet`	IPNET	matches the remote IP network of the fd.
`fd.connected`	BOOL	for TCP/UDP FDs, 'true' if the socket is connected.
`fd.name_changed`	BOOL	True when an event changes the name of an fd used by this event. This can occur in some cases such as udp connections where the connection tuple changes.
`fd.cip.name`	CHARBUF	Domain name associated with the client IP address.
`fd.sip.name`	CHARBUF	Domain name associated with the server IP address.
`fd.lip.name`	CHARBUF	Domain name associated with the local IP address.
`fd.rip.name`	CHARBUF	Domain name associated with the remote IP address.
`fd.dev`	INT32	device number (major/minor) containing the referenced file
`fd.dev.major`	INT32	major device number containing the referenced file
`fd.dev.minor`	INT32	minor device number containing the referenced file
`fd.ino`	INT64	inode number of the referenced file
`fd.nameraw`	CHARBUF	FD full name raw. Just like fd.name, but only used if fd is a file path. File path is kept raw with limited sanitization and without deriving the absolute path.
`fd.types`	LIST(CHARBUF)	List of FD types in used. Can be passed an fd number e.g. fd.types[0] to get the type of stdout as a single item list.
`fd.is_upper_layer`	BOOL	'true' if the fd is of a file in the upper layer of an overlayfs.
`fd.is_lower_layer`	BOOL	'true' if the fd is of a file in the lower layer of an overlayfs.

Field Class: fs.path

Every syscall that has a filesystem path in its arguments has these fields set with information related to the path arguments. This differs from the fd.* fields as it includes syscalls like unlink, rename, etc. that act directly on filesystem paths as compared to opened file descriptors.

Name	Type	Description
`fs.path.name`	CHARBUF	For any event type that deals with a filesystem path, the path the file syscall is operating on. This path is always fully resolved, prepending the thread cwd when needed.
`fs.path.nameraw`	CHARBUF	For any event type that deals with a filesystem path, the path the file syscall is operating on. This path is always the path provided to the syscall and may not be fully resolved.
`fs.path.source`	CHARBUF	For any event type that deals with a filesystem path, and specifically for a source and target like mv, cp, etc, the source path the file syscall is operating on. This path is always fully resolved, prepending the thread cwd when needed.
`fs.path.sourceraw`	CHARBUF	For any event type that deals with a filesystem path, and specifically for a source and target like mv, cp, etc, the source path the file syscall is operating on. This path is always the path provided to the syscall and may not be fully resolved.
`fs.path.target`	CHARBUF	For any event type that deals with a filesystem path, and specifically for a target and target like mv, cp, etc, the target path the file syscall is operating on. This path is always fully resolved, prepending the thread cwd when needed.
`fs.path.targetraw`	CHARBUF	For any event type that deals with a filesystem path, and specifically for a target and target like mv, cp, etc, the target path the file syscall is operating on. This path is always the path provided to the syscall and may not be fully resolved.

Field Class: fdlist

Poll event related fields.

Name	Type	Description
`fdlist.nums`	CHARBUF	for poll events, this is a comma-separated list of the FD numbers in the 'fds' argument, returned as a string.
`fdlist.names`	CHARBUF	for poll events, this is a comma-separated list of the FD names in the 'fds' argument, returned as a string.
`fdlist.cips`	CHARBUF	for poll events, this is a comma-separated list of the client IP addresses in the 'fds' argument, returned as a string.
`fdlist.sips`	CHARBUF	for poll events, this is a comma-separated list of the server IP addresses in the 'fds' argument, returned as a string.
`fdlist.cports`	CHARBUF	for TCP/UDP FDs, for poll events, this is a comma-separated list of the client TCP/UDP ports in the 'fds' argument, returned as a string.
`fdlist.sports`	CHARBUF	for poll events, this is a comma-separated list of the server TCP/UDP ports in the 'fds' argument, returned as a string.

Field Class: container (plugin)

Name	Type	Description
`container.id`	CHARBUF	The truncated container ID (first 12 characters), e.g. 3ad7b26ded6d is extracted from the Linux cgroups by Falco within the kernel. Consequently, this field is reliably available and serves as the lookup key for Falco's synchronous or asynchronous requests against the container runtime socket to retrieve all other 'container.' information. One important aspect to be aware of is that if the process occurs on the host, meaning not in the container PID namespace, this field is set to a string called 'host'. In Kubernetes, pod sandbox container processes can exist where `container.id` matches `k8s.pod.sandbox_id`, lacking other 'container.' details.
`container.full_id`	CHARBUF	The full container ID, e.g. 3ad7b26ded6d8e7b23da7d48fe889434573036c27ae5a74837233de441c3601e. In contrast to `container.id`, we enrich this field as part of the container engine enrichment. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.name`	CHARBUF	The container name. In instances of userspace container engine lookup delays, this field may not be available yet. One important aspect to be aware of is that if the process occurs on the host, meaning not in the container PID namespace, this field is set to a string called 'host'.
`container.image`	CHARBUF	The container image name (e.g. falcosecurity/falco:latest for docker). In instances of userspace container engine lookup delays, this field may not be available yet.
`container.image.id`	CHARBUF	The container image id (e.g. 6f7e2741b66b). In instances of userspace container engine lookup delays, this field may not be available yet.
`container.type`	CHARBUF	The container type, e.g. docker, cri-o, containerd etc.
`container.privileged`	BOOL	'true' for containers running as privileged, 'false' otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mounts`	CHARBUF	A space-separated list of mount information. Each item in the list has the format 'source:dest:mode:rdrw:propagation'. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mount`	CHARBUF	Information about a single mount, specified by number (e.g. container.mount[0]) or mount source (container.mount[/usr/local]). The pathname can be a glob (container.mount[/usr/local/*]), in which case the first matching mount will be returned. The information has the format 'source:dest:mode:rdrw:propagation'. If there is no mount with the specified index or matching the provided source, returns the string "none" instead of a NULL value. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mount.source`	CHARBUF	The mount source, specified by number (e.g. container.mount.source[0]) or mount destination (container.mount.source[/host/lib/modules]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mount.dest`	CHARBUF	The mount destination, specified by number (e.g. container.mount.dest[0]) or mount source (container.mount.dest[/lib/modules]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mount.mode`	CHARBUF	The mount mode, specified by number (e.g. container.mount.mode[0]) or mount source (container.mount.mode[/usr/local]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mount.rdwr`	CHARBUF	The mount rdwr value, specified by number (e.g. container.mount.rdwr[0]) or mount source (container.mount.rdwr[/usr/local]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.mount.propagation`	CHARBUF	The mount propagation value, specified by number (e.g. container.mount.propagation[0]) or mount source (container.mount.propagation[/usr/local]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.image.repository`	CHARBUF	The container image repository (e.g. falcosecurity/falco). In instances of userspace container engine lookup delays, this field may not be available yet.
`container.image.tag`	CHARBUF	The container image tag (e.g. stable, latest). In instances of userspace container engine lookup delays, this field may not be available yet.
`container.image.digest`	CHARBUF	The container image registry digest (e.g. sha256:d977378f890d445c15e51795296e4e5062f109ce6da83e0a355fc4ad8699d27). In instances of userspace container engine lookup delays, this field may not be available yet.
`container.healthcheck`	CHARBUF	The container's health check. Will be the null value ("N/A") if no healthcheck configured, "NONE" if configured but explicitly not created, and the healthcheck command line otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.liveness_probe`	CHARBUF	The container's liveness probe. Will be the null value ("N/A") if no liveness probe configured, the liveness probe command line otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.readiness_probe`	CHARBUF	The container's readiness probe. Will be the null value ("N/A") if no readiness probe configured, the readiness probe command line otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.start_ts`	ABSTIME	Container start as epoch timestamp in nanoseconds based on proc.pidns_init_start_ts and extracted in the kernel and not from the container runtime socket / container engine.
`container.duration`	RELTIME	Number of nanoseconds since container.start_ts.
`container.ip`	CHARBUF	The container's / pod's primary ip address as retrieved from the container engine. Only ipv4 addresses are tracked. Consider container.cni.json (CRI use case) for logging ip addresses for each network interface. In instances of userspace container engine lookup delays, this field may not be available yet.
`container.cni.json`	CHARBUF	The container's / pod's CNI result field from the respective pod status info. It contains ip addresses for each network interface exposed as unparsed escaped JSON string. Supported for CRI container engine (containerd, cri-o runtimes), optimized for containerd (some non-critical JSON keys removed). Useful for tracking ips (ipv4 and ipv6, dual-stack support) for each network interface (multi-interface support). In instances of userspace container engine lookup delays, this field may not be available yet.
`container.host_pid`	BOOL	'true' if the container is running in the host PID namespace, 'false' otherwise.
`container.host_network`	BOOL	'true' if the container is running in the host network namespace, 'false' otherwise.
`container.host_ipc`	BOOL	'true' if the container is running in the host IPC namespace, 'false' otherwise.
`container.label`	CHARBUF	Container label. E.g. 'container.label.foo'.
`container.labels`	CHARBUF	Container comma-separated key/value labels. E.g. 'foo1:bar1,foo2:bar2'.
`proc.is_container_healthcheck`	BOOL	'true' if this process is running as a part of the container's health check.
`proc.is_container_liveness_probe`	BOOL	'true' if this process is running as a part of the container's liveness probe.
`proc.is_container_readiness_probe`	BOOL	'true' if this process is running as a part of the container's readiness probe.
`k8s.pod.name`	CHARBUF	The Kubernetes pod name. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.ns.name`	CHARBUF	The Kubernetes namespace name. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.id`	CHARBUF	[LEGACY] The Kubernetes pod UID, e.g. 3e41dc6b-08a8-44db-bc2a-3724b18ab19a. This legacy field points to `k8s.pod.uid`; however, the pod ID typically refers to the pod sandbox ID. We recommend using the semantically more accurate `k8s.pod.uid` field. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.uid`	CHARBUF	The Kubernetes pod UID, e.g. 3e41dc6b-08a8-44db-bc2a-3724b18ab19a. Note that the pod UID is a unique identifier assigned upon pod creation within Kubernetes, allowing the Kubernetes control plane to manage and track pods reliably. As such, it is fundamentally a different concept compared to the pod sandbox ID. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.sandbox_id`	CHARBUF	The truncated Kubernetes pod sandbox ID (first 12 characters), e.g 63060edc2d3a. The sandbox ID is specific to the container runtime environment. It is the equivalent of the container ID for the pod / sandbox and extracted from the Linux cgroups. As such, it differs from the pod UID. This field is extracted from the container runtime socket simultaneously as we look up the 'container.' fields. In cases of lookup delays, it may not be available yet. In Kubernetes, pod sandbox container processes can exist where `container.id` matches `k8s.pod.sandbox_id`, lacking other 'container.' details.
`k8s.pod.full_sandbox_id`	CHARBUF	The full Kubernetes pod / sandbox ID, e.g 63060edc2d3aa803ab559f2393776b151f99fc5b05035b21db66b3b62246ad6a. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.label`	CHARBUF	The Kubernetes pod label. The label can be accessed either with the familiar brackets notation, e.g. 'k8s.pod.label[foo]' or by appending a dot followed by the name, e.g. 'k8s.pod.label.foo'. The label name itself can include the original special characters such as '.', '-', '_' or '/' characters. For instance, 'k8s.pod.label[app.kubernetes.io/name]', 'k8s.pod.label.app.kubernetes.io/name' or 'k8s.pod.label[custom-label_one]' are all valid. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.labels`	CHARBUF	The Kubernetes pod comma-separated key/value labels. E.g. 'foo1:bar1,foo2:bar2'. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.ip`	CHARBUF	The Kubernetes pod ip, same as container.ip field as each container in a pod shares the network stack of the sandbox / pod. Only ipv4 addresses are tracked. Consider k8s.pod.cni.json for logging ip addresses for each network interface. This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.pod.cni.json`	CHARBUF	The Kubernetes pod CNI result field from the respective pod status info, same as container.cni.json field. It contains ip addresses for each network interface exposed as unparsed escaped JSON string. Supported for CRI container engine (containerd, cri-o runtimes), optimized for containerd (some non-critical JSON keys removed). Useful for tracking ips (ipv4 and ipv6, dual-stack support) for each network interface (multi-interface support). This field is extracted from the container runtime socket simultaneously as we look up the 'container.*' fields. In cases of lookup delays, it may not be available yet.
`k8s.rc.name`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rc.id`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rc.label`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rc.labels`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.svc.name`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.svc.id`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.svc.label`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.svc.labels`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.ns.id`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.ns.label`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.ns.labels`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rs.name`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rs.id`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rs.label`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.rs.labels`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.deployment.name`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.deployment.id`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.deployment.label`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.
`k8s.deployment.labels`	CHARBUF	Deprecated. Use `k8smeta` plugin instead.

Docs: Rules Examples

Mon, 01 Jan 0001 00:00:00 +0000

Here are some examples of the types of behavior falco can detect.

For a more comprehensive set of examples, see the full rules file at falco_rules.yaml.

A shell is run in a container

- macro: container
 condition: container.id != host

- macro: spawned_process
 condition: (evt.type in (execve, execveat))

- rule: run_shell_in_container
 desc: a shell was spawned by a non-shell program in a container. Container entrypoints are excluded.
 condition: container and proc.name = bash and spawned_process and proc.pname exists and not proc.pname in (bash, docker)
 output: "Shell spawned in a container other than entrypoint | user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline"
 priority: WARNING

Unexpected outbound Elasticsearch connection

- macro: outbound
 condition: syscall.type=connect and (fd.typechar=4 or fd.typechar=6)

- macro: elasticsearch_cluster_port
 condition: fd.sport=9300

- rule: elasticsearch_unexpected_network_outbound
 desc: outbound network traffic from elasticsearch on a port other than the standard ports
 condition: user.name = elasticsearch and outbound and not elasticsearch_cluster_port
 output: "Outbound network traffic from Elasticsearch on unexpected port | connection=%fd.name"
 priority: WARNING

Write to directory holding system binaries

- macro: open_write
 condition: >
 (evt.type=open or evt.type=openat) and
 fd.typechar='f' and
 (evt.arg.flags contains O_WRONLY or
 evt.arg.flags contains O_RDWR or
 evt.arg.flags contains O_CREAT or
 evt.arg.flags contains O_TRUNC)

- macro: package_mgmt_binaries
 condition: proc.name in (dpkg, dpkg-preconfigu, rpm, rpmkey, yum)

- macro: bin_dir
 condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)

- rule: write_binary_dir
 desc: an attempt to write to any file below a set of binary directories
 condition: open_write and not package_mgmt_binaries and bin_dir
 output: "File below a known binary directory opened for writing | user=%user.name command=%proc.cmdline file=%fd.name"
 priority: WARNING

Non-authorized container namespace change

- rule: change_thread_namespace
 desc: an attempt to change a program/thread\'s namespace (commonly done as a part of creating a container) by calling setns.
 condition: syscall.type = setns and not proc.name in (docker, sysdig, dragent)
 output: "Namespace change (setns) by unexpected program | user=%user.name command=%proc.cmdline container=%container.id"
 priority: WARNING

Non-device files written in /dev (some rootkits do this)

- rule: create_files_below_dev
 desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev.
 condition: (evt.type = creat or evt.arg.flags contains O_CREAT) and proc.name != blkid and fd.directory = /dev and fd.name != /dev/null
 output: "File created below /dev by untrusted program | user=%user.name command=%proc.cmdline file=%fd.name"
 priority: WARNING

Process other than skype/webex tries to access camera

- rule: access_camera
 desc: a process other than skype/webex tries to access the camera
 condition: evt.type = open and fd.name = /dev/video0 and not proc.name in (skype, webex)
 output: Unexpected process opening camera video device | command=%proc.cmdline
 priority: WARNING

Docs: Default Rules

Mon, 01 Jan 0001 00:00:00 +0000

Falco provides default rules maintained by the maintainers with contributions from the community. More information on this page.

This list presents the default rules based on syscall events.

By default, only the stable rules are loaded by Falco, you can install the sandbox or incubating rules by referencing them in the Helm chart:

helm install falco falcosecurity/falco \
--set "falcoctl.config.artifact.install.refs={falco-rules:3,falco-incubating-rules:4,falco-sandbox-rules:4}" \
--set "falcoctl.config.artifact.follow.refs={falco-rules:3,falco-incubating-rules:4,falco-sandbox-rules:4}" \
--set "falco.rules_files={/etc/falco/k8s_audit_rules.yaml,/etc/falco/rules.d,/etc/falco/falco_rules.yaml,/etc/falco/falco-incubating_rules.yaml,/etc/falco/falco-sandbox_rules.yaml}"

Where the option falcoctl.config.artifact.install.refs governs which rules are downloaded at startup, falcoctl.config.artifact.follow.refs identifies which rules are automatically updated and falco.rules_files indicates which rules are loaded by the engine.

You can find all the rules in their official repository.

Description:

Detect any new SSH connection on port 22 to a host other than those in an allowed list of hosts. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.

Condition:

inbound_outbound and ssh_port and not allowed_ssh_hosts

Output:

Disallowed SSH Connection (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)

Maturity: deprecated

Priority: NOTICE

Tags: maturity_deprecated host container network mitre_lateral_movement T1021.004

Status: disabled

Link:

Description:

Detect any outbound connection to a destination outside of an allowed set of ips, networks, or domain names. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.

Condition:

outbound and not ((fd.sip in (allowed_outbound_destination_ipaddrs)) or
(fd.snet in (allowed_outbound_destination_networks)) or
(fd.sip.name in (allowed_outbound_destination_domains)))

Output:

Disallowed outbound connection destination (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)

Maturity: deprecated

Priority: NOTICE

Tags: maturity_deprecated host container network mitre_command_and_control TA0011

Status: disabled

Link:

Description:

Detect traffic to an unauthorized server process and port within pre-defined containers. This rule absolutely requires profiling your environment beforehand and also necessitates adjusting the list of containers to which this rule will be applied. The current expression logic will never evaluate to true unless the list is populated. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise. Notably, this rule is challenging to operationalize.

Condition:

inbound_outbound and container and container.image.repository in (allowed_image) and not proc.name in (authorized_server_binary) and not fd.sport in (authorized_server_port)

Output:

Network connection outside authorized port and binary (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)

Maturity: deprecated

Priority: WARNING

Tags: maturity_deprecated container network mitre_discovery TA0011 NIST_800-53_CM-7

Status: disabled

Link:

Description:

Detect outbound connections to command and control servers using a list of IP addresses and fully qualified domain names (FQDNs). This rule absolutely requires profiling your environment beforehand and also necessitates adjusting the template lists. The current expression logic will never evaluate to true unless the lists are populated. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise. Notably, this rule is challenging to operationalize.

Condition:

outbound and ((fd.sip in (c2_server_ip_list)) or
(fd.sip.name in (c2_server_fqdn_list)))

Output:

Outbound connection to C2 server (c2_domain=%fd.sip.name c2_addr=%fd.sip connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)

Maturity: deprecated

Priority: WARNING

Tags: maturity_deprecated host container network mitre_command_and_control TA0011

Status: disabled

Link:

Description:

Detect attempts to modify shell configuration files, primarily aimed at establishing persistence by automatically inserting commands into scripts executed by shells. The upstream rule excludes shell processes because they often create unnecessary noise. However, this might lead to missed detections. To customize the rule for your situation, you can fine-tune it using enhanced profiling. For example, you might want to only consider interactive shell processes (where proc.tty != 0).

Condition:

open_write and (fd.filename in (shell_config_filenames) or
fd.name in (shell_config_files) or
fd.directory in (shell_config_directories))
and not proc.name in (shell_binaries) and not exe_running_docker_save and not user_known_shell_config_modifiers

Output:

A shell configuration file has been modified | file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating host container filesystem mitre_persistence T1546.004

Status: enabled

Link:

Description:

Detect scheduled cron jobs; this is a highly generic detection and certainly needs adjustments and profiling in your environment before operationalization. Simultaneously, exploiting the functionality of cron jobs is among one of the oldest TTPs used by adversaries.

Condition:

((open_write and fd.name startswith /etc/cron) or
(spawned_process and proc.name = "crontab"))
and not user_known_cron_jobs

Output:

Cron jobs were scheduled to run | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container filesystem mitre_execution T1053.003

Status: enabled

Link:

Description:

This rule identifies attempts to read files within ssh directories using programs that are not related to ssh. It's a simple and versatile detection method that works well alongside more specific rules focused on sensitive file access. You have a couple of options for using this rule effectively: you can adjust the specialized rules to cover all the important scenarios and ensure precedence in rule smatching for those, or you can analyze the combined view of ssh-related file access across various rules on your downstream computing platform. Just like with other rules, you can narrow down monitoring to specific processes, or you can limit it to interactive access only.

Condition:

(open_read or open_directory)
and (user_ssh_directory or fd.name startswith /root/.ssh)
and not user_known_read_ssh_information_activities
and not proc.name in (ssh_binaries)

Output:

ssh-related file/directory read by non-ssh program | file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: ERROR

Tags: maturity_incubating host container filesystem mitre_collection T1005

Status: enabled

Link:

Description:

A program related to the database server creates an unexpected child process (other than itself). This is not supposed to happen and often follows SQL injection attacks. This behavioral detection could indicate potential unauthorized data extraction or tampering with the database.

Condition:

spawned_process and proc.pname in (db_server_binaries) and not proc.name in (db_server_binaries) and not postgres_running_wal_e and not user_known_db_spawned_processes

Output:

Database-related program spawned process other than itself | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container process database mitre_execution T1190

Status: enabled

Link:

Description:

An attempt to alter the namespace of a process (often performed while creating a container) through the setns syscall. Conversely, the same syscall setns is triggered when an unauthorized attempt is made to break out from the container to the host, for example, when using commands like `nsenter --target 1` and similar ones. Recommending to profile your environment and refine this rule for effective operationalization.

Condition:

evt.type=setns and proc_name_exists and not (container.id=host and proc.name in (docker_binaries, k8s_binaries, lxd_binaries, nsenter)) and not proc.name in (sysdigcloud_binaries, sysdig, calico, oci-umount, cilium-cni, network_plugin_binaries) and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name startswith "runc" and not proc.cmdline startswith "containerd" and not proc.pname in (sysdigcloud_binaries, hyperkube, kubelet, protokube, dockerd, tini, aws) and not java_running_sdjagent and not kubelet_running_loopback and not rancher_agent and not rancher_network_manager and not calico_node and not weaveworks_scope and not user_known_change_thread_namespace_activities

Output:

Namespace change (setns) by unexpected program | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container process mitre_privilege_escalation T1611

Status: enabled

Link:

Description:

Unprivileged users in containers may not have CAP_SYS_ADMIN or other elevated privileges. However, they can use the unshare system call with CLONE_NEWNS or CLONE_NEWUSER to create or clone a namespace or user with the necessary privileges to conduct further attacks. It is best practice to block the unshare system call via seccomp if it is not needed. Misuse of unshare can be related to misconfigured Kubernetes clusters, for example.

Condition:

evt.type=unshare and container and not thread.cap_permitted contains CAP_SYS_ADMIN

Output:

Change namespace privileges via unshare | res=%evt.res evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating container mitre_privilege_escalation T1611

Status: enabled

Link:

Description:

Detect the initial process initiation within a privileged container, with exemptions for known and trusted images. This rule primarily serves as an excellent auditing mechanism since highly privileged containers, when compromised, can result in significant harm. For instance, if another rule triggers within such a privileged container, it could be seen as more suspicious, prompting a closer inspection.

Condition:

container_started and container.privileged=true and not falco_privileged_containers and not user_privileged_containers and not redhat_image

Output:

Privileged container started | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: INFO

Tags: maturity_incubating container cis mitre_execution T1610 PCI_DSS_10.2.5

Status: enabled

Link:

Description:

Identify containers that start with a powerful set of capabilities, with exceptions for recognized trusted images. Similar to the "Launch Privileged Container" rule, this functions as a robust auditing rule. Compromised highly privileged containers can lead to substantial harm. For instance, if another rule is triggered within such a container, it might raise suspicion, prompting closer scrutiny.

Condition:

container_started and excessively_capable_container and not falco_privileged_containers and not user_privileged_containers

Output:

Excessively capable container started | cap_permitted=%thread.cap_permitted evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: INFO

Tags: maturity_incubating container cis mitre_execution T1610

Status: enabled

Link:

Description:

Detect any unexpected network activity performed by system binaries that typically shouldn't perform network activity, including coreutils binaries (like sleep, mkdir, who, date, and others) or user management binaries (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). This serves as a valuable baseline detection for network-related activities.

Condition:

inbound_outbound and fd.sockfamily = ip and (system_procs or proc.name in (shell_binaries)) and not proc.name in (known_system_procs_network_activity_binaries) and not login_doing_dns_lookup and not user_expected_system_procs_network_activity_conditions

Output:

Known system binary sent/received network traffic | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host network process mitre_execution T1059

Status: enabled

Link:

Description:

Detect curl or wget usage with HTTP_PROXY environment variable. Attackers can manipulate the HTTP_PROXY variable's value to redirect application's internal HTTP requests. This could expose sensitive information like authentication keys and private data.

Condition:

spawned_process and http_proxy_procs and proc.env icontains HTTP_PROXY and not allowed_ssh_proxy_env

Output:

Curl or wget run with disallowed HTTP_PROXY environment variable | env=%proc.env evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container users mitre_execution T1204

Status: enabled

Link:

Description:

Detecting UDP traffic on ports other than 53 (DNS) or other commonly used ports. Misusing UDP is a known TTP among attackers. Monitoring unusual network activity is highly valuable but often generates significant noise, as is the case with this detection.

Condition:

inbound_outbound and fd.l4proto=udp and not expected_udp_traffic

Output:

Unexpected UDP Traffic Seen | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container network mitre_exfiltration TA0011

Status: enabled

Link:

Description:

Detect attempts to change users through the use of setuid, with exceptions for sudo/su. The users "root" and "nobody" using setuid on themselves are also excluded, as setuid calls in these cases typically involve reducing privileges. By setting the setuid bit, an attacker could execute code in a different user's context, potentially with higher privileges. One drawback is the potential for noise, as many applications legitimately use this approach.

Condition:

evt.type=setuid and (known_user_in_container or not container) and not (user.name=root or user.uid=0) and not somebody_becoming_themselves and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,
nomachine_binaries)
and not proc.name startswith "runc:" and not java_running_sdjagent and not nrpe_becoming_nagios and not user_known_non_sudo_setuid_conditions

Output:

Unexpected setuid call by non-sudo, non-root program | arg_uid=%evt.arg.uid evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container users mitre_privilege_escalation T1548.001

Status: enabled

Link:

Description:

Detect activity by any programs that can manage users, passwords, or permissions (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). sudo and su are excluded. Activity in containers is also excluded -- some containers create custom users on top of a base linux distribution at startup. Some innocuous command lines that don't actually change anything are excluded. You might want to consider applying this rule to container actions as well.

Condition:

spawned_process and not container and proc.name in (user_mgmt_binaries) and not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and not proc.cmdline startswith "passwd -S" and not proc.cmdline startswith "useradd -D" and not proc.cmdline startswith "systemd --version" and not run_by_qualys and not run_by_sumologic_securefiles and not run_by_yum and not run_by_ms_oms and not run_by_google_accounts_daemon and not chage_list and not user_known_user_management_activities

Output:

User management binary command run outside of container | gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host users software_mgmt mitre_persistence T1098

Status: enabled

Link:

Description:

Detect the creation of files under /dev except for authorized device management programs. This can reveal rootkits hiding files in /dev. Additionally, consider the "Execution from /dev/shm" rule. The upstream rule already covers some tuning scenarios that you can further expand upon.

Condition:

(evt.type = creat or (evt.type in (open,openat,openat2))) and evt.arg.flags contains O_CREAT and fd.directory = /dev and not proc.name in (dev_creation_binaries) and not fd.name in (allowed_dev_files) and not fd.name startswith /dev/tty and not user_known_create_files_below_dev_activities

Output:

File created below /dev by untrusted program | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: ERROR

Tags: maturity_incubating host filesystem mitre_persistence T1543

Status: enabled

Link:

Description:

Detects attempts to communicate with the EC2 Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.

Condition:

outbound and container and fd.sip="169.254.169.254" and not ec2_metadata_containers

Output:

Outbound connection to EC2 instance metadata service | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating network aws container mitre_credential_access T1552.005

Status: enabled

Link:

Description:

Detects attempts to communicate with the Cloud Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.

Condition:

outbound and container and fd.sip="169.254.169.254" and not user_known_metadata_access

Output:

Outbound connection to cloud instance metadata service | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating network container mitre_discovery T1565

Status: enabled

Link:

Description:

Detect package management processes executed within containers. An excellent auditing rule to monitor general drifts in containers. Particularly useful for newer rules like "Drop and execute new binary in container" during incident response investigations. This helps identify common anti-patterns of ad-hoc debugging. Simultaneously, to maintain optimal hygiene, it's recommended to prevent container drifts and instead opt for redeploying new containers.

Condition:

spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs and not user_known_package_manager_in_container and not pkg_mgmt_in_kube_proxy

Output:

Package management process launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: ERROR

Tags: maturity_incubating container process software_mgmt mitre_persistence T1505

Status: enabled

Link:

Description:

Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. This rule complements the more specific "Netcat Remote Code Execution in Container" rule.

Condition:

spawned_process and container and network_tool_procs and not user_known_network_tool_activities

Output:

Network tool launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating container network process mitre_execution T1059

Status: enabled

Link:

Description:

Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. The host equivalent of "Launch Suspicious Network Tool in Container.".

Condition:

spawned_process and not container and network_tool_procs and not user_known_network_tool_activities

Output:

Network tool launched on host | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host network process mitre_execution T1059

Status: enabled

Link:

Description:

Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. Note that it can also trigger when exiting a Terminal shell, such as with `kubectl exec`, which may introduce some noise.

Condition:

(modify_shell_history or truncate_shell_history) and not var_lib_docker_filepath and not proc.name in (docker_binaries)

Output:

Shell history deleted or renamed | file=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating host container process filesystem mitre_defense_evasion T1070

Status: enabled

Link:

Description:

This rule is focused on detecting the use of setuid or setgid bits set via chmod. These bits, when set for an application, result in the application running with the privileges of the owning user or group. By enabling the setuid or setgid bits, an attacker could run code in a different user's context, possibly with elevated privileges. However, there's a trade-off with noise, given that numerous applications legitimately run chmod. This rule is related to the "Non sudo setuid" rule.

Condition:

chmod and (evt.arg.mode contains "S_ISUID" or evt.arg.mode contains "S_ISGID") and not proc.name in (user_known_chmod_applications) and not exe_running_docker_save and not user_known_set_setuid_or_setgid_bit_conditions

Output:

Setuid or setgid bit is set via chmod | fd=%evt.arg.fd filename=%evt.arg.filename mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container process users mitre_privilege_escalation T1548.001

Status: enabled

Link:

Description:

Detect remote file copy tools (like rsync, scp, sftp, dcp) launched within a container, potentially indicating data exfiltration. Suggest refining this rule to accommodate legitimate use cases.

Condition:

spawned_process and container and remote_file_copy_procs and not user_known_remote_file_copy_activities

Output:

Remote file copy tool launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating container network process mitre_exfiltration T1020

Status: enabled

Link:

Description:

Detect network traffic (inbound or outbound) from a container to a destination outside the local subnet. To operationalize this rule, profile your environment and update the template macro namespace_scope_network_only_subnet. Customizing network-related rules usually demands substantial engineering effort to ensure their functionality.

Condition:

inbound_outbound and container and k8s.ns.name in (namespace_scope_network_only_subnet) and not network_local_subnet

Output:

Network connection outside local subnet | fd_rip_name=%fd.rip.name fd_lip_name=%fd.lip.name fd_cip_name=%fd.cip.name fd_sip_name=%fd.sip.name connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating container network mitre_discovery T1046 PCI_DSS_6.4.2

Status: enabled

Link:

Description:

Detect filesystem mounts (using the mount binary) within a privileged container. Due to the elevated privileges, this action could be one of the TTPs used in an attempt to escape from a container to the host. This type of action is often preceded by reconnaissance activities, for which you can also create custom rules.

Condition:

spawned_process and container and container.privileged=true and proc.name=mount and not mount_info and not known_gke_mount_in_privileged_containers and not known_aks_mount_in_privileged_containers and not known_eks_mount_in_privileged_containers and not user_known_mount_in_privileged_containers

Output:

Mount was executed inside a privileged container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating container cis filesystem mitre_privilege_escalation T1611

Status: enabled

Link:

Description:

Detect ingress remote file copy tools (such as curl or wget) launched inside containers. This rule can be considered a valuable auditing tool, but it has the potential to generate notable noise and requires careful profiling before full operationalization.

Condition:

spawned_process and container and (ingress_remote_file_copy_procs or curl_download) and not user_known_ingress_remote_file_copy_activities

Output:

Ingress remote file copy tool launched in container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating container network process mitre_command_and_control TA0011

Status: enabled

Link:

Description:

An attempt to read process environment variables from /proc files. The consequences are akin to accessing traditional sensitive files, as sensitive data, including secrets, might be stored in environment variables. Understanding your environment, such as identifying critical namespaces, and incorporating extra filtering statements to alert exclusively for those, can enhance the rule's effectiveness.

Condition:

open_read and container and (fd.name glob /proc/*/environ) and not proc.name in (known_binaries_to_read_environment_variables_from_proc_files)

Output:

Environment variables were retrieved from /proc files | file=%fd.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating container filesystem process mitre_discovery T1083

Status: enabled

Link:

Description:

Detect the copying of artifacts from a container's file system using the Kubernetes control plane (kubectl cp). This rule can identify potential exfiltration of application secrets from containers' file systems, potentially revealing the outcomes of unauthorized access and control plane misuse via stolen identities (such as stolen credentials like Kubernetes serviceaccount tokens). Can be customized by the adopter to only monitor specific artifact paths, containers, or namespaces as needed.

Condition:

open_read and container and proc.name=tar and container_entrypoint and proc.tty=0 and not system_level_side_effect_artifacts_kubectl_cp

Output:

Exfiltrating Artifacts via Kubernetes Control Plane | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating container filesystem mitre_exfiltration TA0010

Status: enabled

Link:

Description:

After gaining access, attackers can modify the authorized_keys file to maintain persistence on a victim host. Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. This rules aims at detecting any modification to the authorized_keys file, that is usually located under the .ssh directory in any user's home directory. This rule complements the more generic auditing rule "Read ssh information" by specifically detecting the writing of new, potentially attacker-provided keys.

Condition:

open_write and (user_ssh_directory or fd.name startswith /root/.ssh) and fd.name endswith authorized_keys and not proc.name in (ssh_binaries)

Output:

Adding ssh keys to authorized_keys | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating host filesystem mitre_persistence T1098.004

Status: enabled

Link:

Description:

Process run with suspect environment variable that could be attempting privilege escalation. One use case is detecting the use of the GLIBC_TUNABLES environment variable, which could be used for privilege escalation on systems running vulnerable glibc versions. Only known and carefully profiled processes that legitimately exhibit this behavior should be excluded from this rule. This rule is expected to trigger on every attempt, even failed ones.

Condition:

spawned_process and glibc_tunables_env

Output:

Process run with suspect environment variable which could be attempting privilege escalation | env=%proc.env evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container users mitre_privilege_escalation TA0004

Status: enabled

Link:

Description:

This rule detects possible CVE-2024-3094 exploitation when the SSH daemon process loads a vulnerable version of the liblzma library. An attacker could exploit this to interfere with authentication in sshd via systemd, potentially compromising sensitive data or escalating their privileges.

Condition:

open_read and proc.name=sshd and (fd.name contains "liblzma.so.5.6.0" or fd.name contains "liblzma.so.5.6.1")

Output:

SSHD loaded a backdoored version of liblzma library %fd.name with parent %proc.pname and cmdline %proc.cmdline | process=%proc.name parent=%proc.pname file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid proc_exepath=%proc.exepath command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: incubating

Priority: WARNING

Tags: maturity_incubating host container mitre_initial_access T1556

Status: enabled

Link:

Description:

BPF is a kernel technology that can be misused for malicious purposes, like "Linux Kernel Module Injection". This rule should be considered an auditing rule to notify you of any unprofiled BPF tools running in your environment. However, it requires customization after profiling your environment. BPF-powered agents make bpf syscalls all the time, so this rule only sends logs for BPF_PROG_LOAD calls (bpf cmd=5) in the enter event. If you also want to log whether the syscall failed or succeeded, remove the direction filter and add the evt.arg.res_or_fd output field.

Condition:

evt.type=bpf and (evt.arg.cmd=5 or evt.arg.cmd=BPF_PROG_LOAD) and not bpf_profiled_procs

Output:

BPF Program Not Profiled | bpf_cmd=%evt.arg.cmd evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: incubating

Priority: NOTICE

Tags: maturity_incubating host container mitre_persistence TA0003

Status: enabled

Link:

Description:

Detect any inbound connection from a source outside of an allowed set of ips, networks, or domain names. This rule absolutely requires profiling your environment beforehand. Network-based rules are extremely crucial in any security program, as they can often provide the only definitive evidence. However, effectively operationalizing them can be challenging due to the potential for noise.

Condition:

inbound and not ((fd.cip in (allowed_inbound_source_ipaddrs)) or
(fd.cnet in (allowed_inbound_source_networks)) or
(fd.cip.name in (allowed_inbound_source_domains)))

Output:

Disallowed inbound connection source | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox host container network mitre_command_and_control TA0011

Status: disabled

Link:

Description:

This rule detects attempts made by non-shell programs to read shell configuration files. It offers additional generic auditing. It serves as a baseline detection alert for unusual shell configuration file accesses. The rule "Modify Shell Configuration File" might be more relevant and adequate for your specific cases.

Condition:

open_read and (fd.filename in (shell_config_filenames) or
fd.name in (shell_config_files) or
fd.directory in (shell_config_directories))
and not proc.name in (shell_binaries)

Output:

A shell configuration file was read by a non-shell program | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: WARNING

Tags: maturity_sandbox host container filesystem mitre_discovery T1546.004

Status: disabled

Link:

Description:

This rule generically detects updates to package repositories and can be seen as an auditing measure. Recommend evaluating its relevance for your specific environment.

Condition:

((open_write and access_repositories) or (modify and modify_repositories)) and not package_mgmt_procs and not package_mgmt_ancestor_procs and not exe_running_docker_save and not user_known_update_package_registry

Output:

Repository files get updated | newpath=%evt.arg.newpath file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox host container filesystem mitre_execution T1072

Status: enabled

Link:

Description:

Trying to write to any file below specific binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

open_write and bin_dir and not package_mgmt_procs and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms and not user_known_write_below_binary_dir_activities

Output:

File below a known binary directory opened for writing | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem mitre_persistence T1543

Status: enabled

Link:

Description:

Trying to write to any file below a set of monitored directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

open_write and monitored_dir and not package_mgmt_procs and not coreos_write_ssh_dir and not exe_running_docker_save and not python_running_get_pip and not python_running_ms_oms and not google_accounts_daemon_writing_ssh and not cloud_init_writing_ssh and not user_known_write_monitored_dir_conditions

Output:

File below a monitored directory opened for writing | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem mitre_persistence T1543

Status: enabled

Link:

Description:

Trying to write to any file below /etc can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

write_etc_common

Output:

File below /etc opened for writing | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem mitre_persistence T1098

Status: enabled

Link:

Description:

Trying to write to any file directly below / or /root can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases. Lastly, this rule stands out as potentially the noisiest one among rules related to "write below.

Condition:

open_write and root_dir and proc_name_exists and not fd.name in (known_root_files) and not fd.directory pmatch (known_root_directories) and not exe_running_docker_save and not gugent_writing_guestagent_log and not dse_writing_tmp and not zap_writing_state and not airflow_writing_state and not rpm_writing_root_rpmdb and not maven_writing_groovy and not chef_writing_conf and not kubectl_writing_state and not cassandra_writing_state and not galley_writing_state and not calico_writing_state and not rancher_writing_root and not runc_writing_exec_fifo and not mysqlsh_writing_state and not known_root_conditions and not user_known_write_root_conditions and not user_known_write_below_root_activities

Output:

File below / or /root opened for writing | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem mitre_persistence TA0003

Status: enabled

Link:

Description:

Trying to write to the rpm database by any non-rpm related program can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

open_write and fd.name startswith /var/lib/rpm and not rpm_procs and not ansible_running_python and not python_running_chef and not exe_running_docker_save and not amazon_linux_running_python_yum and not user_known_write_rpm_database_activities

Output:

rpm database opened for writing by a non-rpm program | file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem software_mgmt mitre_persistence T1072

Status: enabled

Link:

Description:

Trying to modify any file below a set of binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

modify and bin_dir_rename and not package_mgmt_procs and not exe_running_docker_save and not user_known_modify_bin_dir_activities

Output:

File below known binary directory renamed/removed | file=%fd.name pcmdline=%proc.pcmdline evt_args=%evt.args evt_type=%evt.type evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem mitre_defense_evasion T1222.002

Status: enabled

Link:

Description:

Trying to create a directory below a set of binary directories can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

mkdir and bin_dir_mkdir and not package_mgmt_procs and not user_known_mkdir_bin_dir_activities and not exe_running_docker_save

Output:

Directory below known binary directory created | directory=%evt.arg.path evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox host container filesystem mitre_persistence T1222.002

Status: enabled

Link:

Description:

Detect the initial process launched within a container that has a mount from a sensitive host directory (e.g. /proc). Exceptions are made for known trusted images. This rule holds value for generic auditing; however, its noisiness varies based on your environment.

Condition:

container_started and sensitive_mount and not falco_sensitive_mount_containers and not user_sensitive_mount_containers

Output:

Container with sensitive mount started | mounts=%container.mounts evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: INFO

Tags: maturity_sandbox container cis mitre_execution T1610

Status: enabled

Link:

Description:

Detect the initial process launched within a container that is not in a list of allowed containers. This rule holds value for generic auditing; however, this rule requires a good understanding of your setup and consistent effort to keep the list of allowed containers current. In some situations, this can be challenging to manage.

Condition:

container_started and not allowed_containers

Output:

Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: WARNING

Tags: maturity_sandbox container mitre_lateral_movement T1610

Status: enabled

Link:

Description:

Any inbound network activity performed by any interpreted program (perl, python, ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing it effectively requires significant time and might result in a moderate level of noise. Suggesting customizing this rule to be more specific. For example, you could set it up to alert only for important namespaces after studying their usual behavior.

Condition:

inbound and interpreted_procs

Output:

Interpreted program received/listened for network traffic | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox host container network mitre_exfiltration TA0011

Status: disabled

Link:

Description:

Any outbound network activity performed by any interpreted program (perl, python, ruby, etc.). While it offers broad coverage and behavioral insights, operationalizing it effectively requires significant time and might result in a moderate level of noise. Suggesting customizing this rule to be more specific. For example, you could set it up to alert only for important namespaces after studying their usual behavior.

Condition:

outbound and interpreted_procs

Output:

Interpreted program performed outgoing network connection | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox host container network mitre_exfiltration TA0011

Status: disabled

Link:

Description:

Detect attempts to utilize K8s NodePorts from a container. K8s NodePorts are accessible on the eth0 interface of each node, and they facilitate external traffic into a Kubernetes cluster. Attackers could misuse them for unauthorized access. The rule uses default port ranges, but check for custom ranges and make necessary adjustments. Also, consider tuning this rule as needed.

Condition:

inbound_outbound and container and fd.sport >= 30000 and fd.sport <= 32767 and not nodeport_containers

Output:

Unexpected K8s NodePort Connection | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox network k8s container mitre_persistence T1205.001 NIST_800-53_AC-6

Status: disabled

Link:

Description:

Detecting hidden files or directories creation can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Condition:

((modify and evt.arg.newpath contains "/.") or
(mkdir and evt.arg.path contains "/.") or
(open_write and evt.arg.flags contains "O_CREAT" and fd.name contains "/." and not fd.name pmatch (exclude_hidden_directories)))
and not user_known_create_hidden_file_activities and not exe_running_docker_save

Output:

Hidden file or directory created | file=%fd.name newpath=%evt.arg.newpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox host container filesystem mitre_defense_evasion T1564.001

Status: disabled

Link:

Description:

Miners usually connect to miner pools using standard ports, and this rule flags such activity. Important: Falco currently sends DNS requests to resolve miner pool domains, which could trigger other alerts. Prior to enabling this rule, it's advised to ensure whether this is acceptable for your environment. This rule is specifically disabled for that reason.

Condition:

net_miner_pool and not trusted_images_query_miner_domain_dns

Output:

Outbound connection to IP/Port flagged by https://cryptoioc.ch | ip=%fd.rip connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: CRITICAL

Tags: maturity_sandbox host container network mitre_impact T1496

Status: disabled

Link:

Description:

Miners commonly specify the mining pool to connect to using a URI that starts with "stratum+tcp". However, this rule is highly specific to this technique, and matching command-line arguments can generally be bypassed quite easily.

Condition:

spawned_process and (proc.cmdline contains "stratum+tcp" or
proc.cmdline contains "stratum2+tcp" or
proc.cmdline contains "stratum+ssl" or
proc.cmdline contains "stratum2+ssl")

Output:

Possible miner running | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: CRITICAL

Tags: maturity_sandbox host container process mitre_impact T1496

Status: enabled

Link:

Description:

Detect the execution of a Kubernetes client tool (like docker, kubectl, crictl) within a container, which is typically not expected behavior. Although this rule targets container workloads, monitoring the use of tools like crictl on the host over interactive access could also be valuable for broader auditing objectives.

Condition:

spawned_process and container and not user_known_k8s_client_container_parens and proc.name in (k8s_client_binaries)

Output:

Kubernetes Client Tool Launched in Container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: WARNING

Tags: maturity_sandbox container mitre_execution T1610

Status: enabled

Link:

Description:

Detect new executables created within a container as a result of chmod. While this detection can generate significant noise, chmod usage is frequently linked to dropping and executing malicious implants. The newer rule "Drop and execute new binary in container" provides more precise detection of this TTP using unambiguous kernel signals. It is recommended to use the new rule. However, this rule might be more relevant for auditing if applicable in your environment, such as when chmod is used on files within the /tmp folder.

Condition:

chmod and container and evt.rawres>=0 and ((evt.arg.mode contains "S_IXUSR") or
(evt.arg.mode contains "S_IXGRP") or
(evt.arg.mode contains "S_IXOTH"))
and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities

Output:

Drift detected (chmod), new executable created in a container | filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox container process filesystem mitre_execution T1059

Status: disabled

Link:

Description:

Detect new executables created within a container as a result of open+create. The newer rule "Drop and execute new binary in container" provides more precise detection of this TTP using unambiguous kernel signals. It is recommended to use the new rule.

Condition:

evt.type in (open,openat,openat2,creat) and evt.rawres>=0 and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities

Output:

Drift detected (open+create), new executable created in a container | filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: ERROR

Tags: maturity_sandbox container process filesystem mitre_execution T1059

Status: disabled

Link:

Description:

Container detected running as the root user. This should be taken into account especially when policies disallow containers from running with root user privileges. Note that a root user in containers doesn't inherently possess extensive power, as modern container environments define privileges through Linux capabilities. To learn more, check out the rule "Launch Privileged Container".

Condition:

spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container

Output:

Container launched with root user privilege | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: INFO

Tags: maturity_sandbox container process users mitre_execution T1610

Status: disabled

Link:

Description:

Affecting sudo (<= 1.9.5p2), there's a privilege escalation vulnerability. By executing sudo using the sudoedit -s or sudoedit -i command with a command-line argument that ends with a single backslash character, an unprivileged user can potentially escalate privileges to root. This rule is highly specific and might be bypassed due to potential issues with string matching on command line arguments.

Condition:

spawned_process and user.uid != 0 and (proc.name=sudoedit or proc.name = sudo) and (proc.args contains -s or proc.args contains -i or proc.args contains --login) and (proc.args contains "\ " or proc.args endswith \)

Output:

Detect Sudo Privilege Escalation Exploit (CVE-2021-3156) | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: CRITICAL

Tags: maturity_sandbox host container filesystem users mitre_privilege_escalation T1548.003

Status: enabled

Link:

Description:

Detect a successful unprivileged userfaultfd syscall, which could serve as an attack primitive for exploiting other vulnerabilities. To fine-tune this rule, consider using the template list "user_known_userfaultfd_processes".

Condition:

evt.type = userfaultfd and user.uid != 0 and (evt.rawres >= 0 or evt.res != -1) and not proc.name in (user_known_userfaultfd_processes)

Output:

An userfaultfd syscall was successfully executed by an unprivileged user | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: CRITICAL

Tags: maturity_sandbox host container process mitre_defense_evasion TA0005

Status: enabled

Link:

Description:

This rule detects attempts to exploit a privilege escalation vulnerability in Polkit's pkexec. Through the execution of specially crafted code, a local user can exploit this weakness to attain root privileges on a compromised system. This rule is highly specific in its scope.

Condition:

spawned_process and user.uid != 0 and proc.name=pkexec and proc.args = ''

Output:

Detect Polkit pkexec Local Privilege Escalation Exploit (CVE-2021-4034) | args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: CRITICAL

Tags: maturity_sandbox host container process users mitre_privilege_escalation TA0004

Status: enabled

Link:

Description:

Detecting a Java process downloading a class file which could indicate a successful exploit of the log4shell Log4j vulnerability (CVE-2021-44228). This rule is highly specific in its scope.

Condition:

java_network_read and evt.buffer bcontains cafebabe

Output:

Java process class file download | server_ip=%fd.sip server_port=%fd.sport connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: CRITICAL

Tags: maturity_sandbox host container process mitre_initial_access T1190

Status: disabled

Link:

Description:

This rule detect an attempt to write on container entrypoint symlink (/proc/self/exe). Possible CVE-2019-5736 Container Breakout exploitation attempt. This rule has a more narrow scope.

Condition:

open_write and container and (fd.name=/proc/self/exe or fd.name startswith /proc/self/fd/) and not docker_procs and not proc.cmdline = "runc:[1:CHILD] init"

Output:

Detect Potential Container Breakout Exploit (CVE-2019-5736) | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: sandbox

Priority: WARNING

Tags: maturity_sandbox container filesystem mitre_initial_access T1611

Status: disabled

Link:

Description:

Detect any use of {base64} decoding in a container. Legitimate applications may decode encoded payloads. The template list known_decode_payload_containers can be used for simple tuning and customization, or you can adopt custom, more refined tuning. Less sophisticated adversaries may {base64}-decode their payloads not only to obfuscate them, but also to ensure that the payload remains intact when the application processes it. Note that injecting commands into an application's input often results in the application processing passed strings like "sh -c". In these cases, you may be lucky and the encoded blob will also be logged. Otherwise, all you will see is the {base64} decoding command, as the encoded blob was already interpreted by the shell.

Condition:

spawned_process and container and base64_decoding and not container.image.repository in (known_decode_payload_containers)

Output:

Decoding Payload in Container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: INFO

Tags: maturity_sandbox container process mitre_command_and_control T1132

Status: enabled

Link:

Description:

This rule detects basic interactive reconnaissance commands that are typically run by unsophisticated attackers or used in internal Red Team exercises. Interactive is defined as a terminal being present (proc.tty != 0). This could be any form of reverse shell or usage of kubectl exec or ssh etc. In addition, filtering for the process being the process group leader indicates that the command was "directly" typed into the terminal and not run as a result of a script. This rule is a basic auditing or template rule. You can expand the list of reconnaissance commands, such as by adding "ls". Common anti-patterns are SRE activity or debugging, but it is still worth capturing this generically. Typically, you would expect other rules to fire as well in relation to this activity.

Condition:

spawned_process and recon_binaries_procs and proc.tty != 0 and proc.is_vpgid_leader=true

Output:

Basic Interactive Reconnaissance | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: NOTICE

Tags: maturity_sandbox host container process mitre_reconnaissance TA0043

Status: enabled

Link:

Description:

Netcat/Socat Program runs on host that allows remote code execution and may be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/. These programs are of higher relevance as they are commonly installed on UNIX-like operating systems.

Condition:

spawned_process and not container and ((proc.name = "nc" and (proc.cmdline contains "-e" or
proc.cmdline contains "-c")) or
(proc.name = "ncat" and (proc.args contains "--sh-exec" or
proc.args contains "--exec" or proc.args contains "-e " or
proc.args contains "-c " or proc.args contains "--lua-exec")) or
(proc.name = 'socat' and (proc.args contains "EXEC" or
proc.args contains "SYSTEM")))

Output:

Netcat/Socat runs on host that allows remote code execution | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: sandbox

Priority: WARNING

Tags: maturity_sandbox host network process mitre_execution T1059

Status: enabled

Link:

Description:

Web applications can be vulnerable to directory traversal attacks that allow accessing files outside of the web app's root directory (e.g. Arbitrary File Read bugs). System directories like /etc are typically accessed via absolute paths. Access patterns outside of this (here path traversal) can be regarded as suspicious. This rule includes failed file open attempts.

Condition:

(open_read or open_file_failed) and (etc_dir or user_ssh_directory or
fd.name startswith /root/.ssh or
fd.name contains "id_rsa")
and directory_traversal and not proc.pname in (shell_binaries)

Output:

Read monitored file via directory traversal | file=%fd.name fileraw=%fd.nameraw gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container filesystem mitre_credential_access T1555

Status: enabled

Link:

Description:

An attempt to read any sensitive file (e.g. files containing user/password/authentication information) by a trusted program after startup. Trusted programs might read these files at startup to load initial state, but not afterwards. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rules for critical application credentials unique to your environment.

Condition:

open_read and sensitive_files and server_procs and not proc_is_new and proc.name!="sshd" and not user_known_read_sensitive_files_activities

Output:

Sensitive file opened for reading by trusted program after startup | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container filesystem mitre_credential_access T1555

Status: enabled

Link:

Description:

An attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs. Can be customized as needed. In modern containerized cloud infrastructures, accessing traditional Linux sensitive files might be less relevant, yet it remains valuable for baseline detections. While we provide additional rules for SSH or cloud vendor-specific credentials, you can significantly enhance your security program by crafting custom rules for critical application credentials unique to your environment.

Condition:

open_read and sensitive_files and proc_name_exists and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,
cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,
vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,
in.proftpd, mandb, salt-call, salt-minion, postgres_mgmt_binaries,
google_oslogin_
)
and not cmp_cp_by_passwd and not ansible_running_python and not run_by_qualys and not run_by_chef and not run_by_google_accounts_daemon and not user_read_sensitive_file_conditions and not mandb_postinst and not perl_running_plesk and not perl_running_updmap and not veritas_driver_script and not perl_running_centrifydc and not runuser_reading_pam and not linux_bench_reading_etc_shadow and not user_known_read_sensitive_files_activities and not user_read_sensitive_file_containers

Output:

Sensitive file opened for reading by non-trusted program | file=%fd.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container filesystem mitre_credential_access T1555

Status: enabled

Link:

Description:

An attempt to spawn a shell below a non-shell application. The non-shell applications that are monitored are defined in the protected_shell_spawner macro, with protected_shell_spawning_binaries being the list you can easily customize. For Java parent processes, please note that Java often has a custom process name. Therefore, rely more on proc.exe to define Java applications. This rule can be noisier, as you can see in the exhaustive existing tuning. However, given it is very behavior-driven and broad, it is universally relevant to catch general Remote Code Execution (RCE). Allocate time to tune this rule for your use cases and reduce noise. Tuning suggestions include looking at the duration of the parent process (proc.ppid.duration) to define your long-running app processes. Checking for newer fields such as proc.vpgid.name and proc.vpgid.exe instead of the direct parent process being a non-shell application could make the rule more robust.

Condition:

spawned_process and shell_procs and proc.pname exists and protected_shell_spawner and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,
needrestart_binaries,
mesos_shell_binaries,
erl_child_setup, exechealthz,
PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,
lb-controller, nvidia-installe, runsv, statsite, erlexec, calico-node,
"puma reactor")
and not proc.cmdline in (known_shell_spawn_cmdlines) and not proc.aname in (unicorn_launche) and not consul_running_net_scripts and not consul_running_alert_checks and not nginx_starting_nginx and not nginx_running_aws_s3_cp and not run_by_package_mgmt_binaries and not serf_script and not check_process_status and not run_by_foreman and not python_mesos_marathon_scripting and not splunk_running_forwarder and not postgres_running_wal_e and not redis_running_prepost_scripts and not rabbitmq_running_scripts and not rabbitmqctl_running_scripts and not run_by_appdynamics and not user_shell_container_exclusions

Output:

Shell spawned by untrusted binary | parent_exe=%proc.pexe parent_exepath=%proc.pexepath pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: NOTICE

Tags: maturity_stable host container process shell mitre_execution T1059.004

Status: enabled

Link:

Description:

System (e.g. non-login) users spawning new processes. Can add custom service users (e.g. apache or mysqld). 'Interactive' is defined as new processes as descendants of an ssh session or login process. Consider further tuning by only looking at processes in a terminal / tty (proc.tty != 0). A newer field proc.is_vpgid_leader could be of help to distinguish if the process was "directly" executed, for instance, in a tty, or executed as a descendant process in the same process group, which, for example, is the case when subprocesses are spawned from a script. Consider this rule as a great template rule to monitor interactive accesses to your systems more broadly. However, such a custom rule would be unique to your environment. The rule "Terminal shell in container" that fires when using "kubectl exec" is more Kubernetes relevant, whereas this one could be more interesting for the underlying host.

Condition:

spawned_process and system_users and interactive and not user_known_system_user_login

Output:

System user ran an interactive command | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: INFO

Tags: maturity_stable host container users mitre_execution T1059 NIST_800-53_AC-2

Status: enabled

Link:

Description:

A shell was used as the entrypoint/exec point into a container with an attached terminal. Parent process may have legitimately already exited and be null (read container_entrypoint macro). Common when using "kubectl exec" in Kubernetes. Correlate with k8saudit exec logs if possible to find user or serviceaccount token used (fuzzy correlation by namespace and pod name). Rather than considering it a standalone rule, it may be best used as generic auditing rule while examining other triggered rules in this container/tty.

Condition:

spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint and not user_expected_terminal_shell_in_container_conditions

Output:

A shell was spawned in a container with an attached terminal | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: NOTICE

Tags: maturity_stable container shell mitre_execution T1059

Status: enabled

Link:

Description:

Detect attempts to communicate with the K8S API Server from a container by non-profiled users. Kubernetes APIs play a pivotal role in configuring the cluster management lifecycle. Detecting potential unauthorized access to the API server is of utmost importance. Audit your complete infrastructure and pinpoint any potential machines from which the API server might be accessible based on your network layout. If Falco can't operate on all these machines, consider analyzing the Kubernetes audit logs (typically drained from control nodes, and Falco offers a k8saudit plugin) as an additional data source for detections within the control plane.

Condition:

evt.type=connect and (fd.typechar=4 or fd.typechar=6) and container and k8s_api_server and not k8s_containers and not user_known_contact_k8s_api_server_activities

Output:

Unexpected connection to K8s API Server from container | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: NOTICE

Tags: maturity_stable container network k8s mitre_discovery T1565

Status: enabled

Link:

Description:

Netcat Program runs inside container that allows remote code execution and may be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/. These programs are of higher relevance as they are commonly installed on UNIX-like operating systems. Can fire in combination with the "Redirect STDOUT/STDIN to Network Connection in Container" rule as it utilizes a different evt.type.

Condition:

spawned_process and container and ((proc.name = "nc" and (proc.cmdline contains " -e" or
proc.cmdline contains " -c")) or
(proc.name = "ncat" and (proc.args contains "--sh-exec" or
proc.args contains "--exec" or proc.args contains "-e " or
proc.args contains "-c " or proc.args contains "--lua-exec"))
)

Output:

Netcat runs inside container that allows remote code execution | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: WARNING

Tags: maturity_stable container network process mitre_execution T1059

Status: enabled

Link:

Description:

Detect attempts to search for private keys or passwords using the grep or find command. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level.

Condition:

spawned_process and ((grep_commands and private_key_or_password) or
(proc.name = "find" and (proc.args contains "id_rsa" or
proc.args contains "id_dsa" or
proc.args contains "id_ed25519" or
proc.args contains "id_ecdsa"
)
))

Output:

Grep private keys or passwords activities found | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container process filesystem mitre_credential_access T1552.001

Status: enabled

Link:

Description:

Detect clearing of critical access log files, typically done to erase evidence that could be attributed to an adversary's actions. To effectively customize and operationalize this detection, check for potentially missing log file destinations relevant to your environment, and adjust the profiled containers you wish not to be alerted on.

Condition:

open_write and access_log_files and evt.arg.flags contains "O_TRUNC" and not containerd_activities and not trusted_logging_images and not allowed_clear_log_files

Output:

Log files were tampered | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container filesystem mitre_defense_evasion T1070 NIST_800-53_AU-10

Status: enabled

Link:

Description:

Detect a process running to clear bulk data from disk with the intention to destroy data, possibly interrupting availability to systems. Profile your environment and use user_known_remove_data_activities to tune this rule.

Condition:

spawned_process and clear_data_procs and not user_known_remove_data_activities

Output:

Bulk data has been removed from disk | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container process filesystem mitre_impact T1485

Status: enabled

Link:

Description:

Detect symlinks created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted".

Condition:

create_symlink and (evt.arg.target in (sensitive_file_names) or evt.arg.target in (sensitive_directory_names))

Output:

Symlinks created over sensitive files | target=%evt.arg.target linkpath=%evt.arg.linkpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container filesystem mitre_credential_access T1555

Status: enabled

Link:

Description:

Detect hardlink created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted".

Condition:

create_hardlink and (evt.arg.oldpath in (sensitive_file_names))

Output:

Hardlinks created over sensitive files | target=%evt.arg.oldpath linkpath=%evt.arg.newpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container filesystem mitre_credential_access T1555

Status: enabled

Link:

Description:

Detect new packet socket at the device driver (OSI Layer 2) level in a container. Packet socket could be used for ARP Spoofing and privilege escalation (CVE-2020-14386) by an attacker. Noise can be reduced by using the user_known_packet_socket_binaries template list.

Condition:

evt.type=socket and container and evt.arg.domain contains AF_PACKET and not proc.name in (user_known_packet_socket_binaries)

Output:

Packet socket was created in a container | socket_info=%evt.args connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: NOTICE

Tags: maturity_stable container network mitre_credential_access T1557.002

Status: enabled

Link:

Description:

Detect redirection of stdout/stdin to a network connection within a container, achieved by utilizing a variant of the dup syscall (potential reverse shell or remote code execution https://github.com/swisskyrepo/PayloadsAllTheThings/). This detection is behavior-based and may generate noise in the system, and can be adjusted using the user_known_stand_streams_redirect_activities template macro. Tuning can be performed similarly to existing detections based on process lineage or container images, and/or it can be limited to interactive tty (tty != 0).

Condition:

dup and container and evt.rawres in (0, 1, 2) and fd.type in ("ipv4", "ipv6") and not user_known_stand_streams_redirect_activities

Output:

Redirect stdout/stdin to network connection | gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] fd.sip=%fd.sip connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: NOTICE

Tags: maturity_stable container network process mitre_execution T1059

Status: enabled

Link:

Description:

Inject Linux Kernel Modules from containers using insmod or modprobe with init_module and finit_module syscalls, given the precondition of sys_module effective capabilities. Profile the environment and consider allowed_container_images_loading_kernel_module to reduce noise and account for legitimate cases.

Condition:

kernel_module_load and container and thread.cap_effective icontains sys_module and not container.image.repository in (allowed_container_images_loading_kernel_module)

Output:

Linux Kernel Module injection from container | parent_exepath=%proc.pexepath gparent=%proc.aname[2] gexepath=%proc.aexepath[2] module=%proc.args res=%evt.res evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container process mitre_persistence TA0003

Status: enabled

Link:

Description:

Detect file system debugger debugfs launched inside a privileged container which might lead to container escape. This rule has a more narrow scope.

Condition:

spawned_process and container and container.privileged=true and proc.name=debugfs

Output:

Debugfs launched started in a privileged container | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: WARNING

Tags: maturity_stable container cis process mitre_privilege_escalation T1611

Status: enabled

Link:

Description:

Detect an attempt to exploit a container escape using release_agent file. By running a container with certains capabilities, a privileged user can modify release_agent file and escape from the container.

Condition:

open_write and container and fd.name endswith release_agent and (user.uid=0 or thread.cap_effective contains CAP_DAC_OVERRIDE) and thread.cap_effective contains CAP_SYS_ADMIN

Output:

Detect an attempt to exploit a container escape using release_agent file | file=%fd.name cap_effective=%thread.cap_effective evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: CRITICAL

Tags: maturity_stable container process mitre_privilege_escalation T1611

Status: enabled

Link:

Description:

Detect an attempt to inject potentially malicious code into a process using PTRACE in order to evade process-based defenses or elevate privileges. Common anti-patterns are debuggers. Additionally, profiling your environment via the known_ptrace_procs template macro can reduce noise. A successful ptrace syscall generates multiple logs at once.

Condition:

ptrace_attach_or_injection and proc_name_exists and not known_ptrace_procs

Output:

Detected ptrace PTRACE_ATTACH attempt | proc_pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container process mitre_privilege_escalation T1055.008

Status: enabled

Link:

Description:

Detect usage of the PTRACE system call with the PTRACE_TRACEME argument, indicating a program actively attempting to avoid debuggers attaching to the process. This behavior is typically indicative of malware activity. Read more about PTRACE in the "PTRACE attached to process" rule.

Condition:

evt.type=ptrace and evt.arg.request contains PTRACE_TRACEME and proc_name_exists

Output:

Detected potential PTRACE_TRACEME anti-debug attempt | proc_pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: NOTICE

Tags: maturity_stable host container process mitre_defense_evasion T1622

Status: enabled

Link:

Description:

Detect attempts to search for private keys or passwords using the grep or find command, particularly targeting standard AWS credential locations. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level. This rule complements the rule "Search Private Keys or Passwords".

Condition:

spawned_process and ((grep_commands and private_aws_credentials) or
(proc.name = "find" and proc.args endswith ".aws/credentials"))

Output:

Detected AWS credentials search activity | proc_pcmdline=%proc.pcmdline proc_cwd=%proc.cwd group_gid=%group.gid group_name=%group.name user_loginname=%user.loginname evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container process aws mitre_credential_access T1552

Status: enabled

Link:

Description:

This rule detects file execution in the /dev/shm directory, a tactic often used by threat actors to store their readable, writable, and occasionally executable files. /dev/shm acts as a link to the host or other containers, creating vulnerabilities for their compromise as well. Notably, /dev/shm remains unchanged even after a container restart. Consider this rule alongside the newer "Drop and execute new binary in container" rule.

Condition:

spawned_process and (proc.exe startswith "/dev/shm/" or
(proc.cwd startswith "/dev/shm/" and proc.exe startswith "./" ) or
(shell_procs and proc.args startswith "-c /dev/shm") or
(shell_procs and proc.args startswith "-i /dev/shm") or
(shell_procs and proc.args startswith "/dev/shm") or
(proc.cwd startswith "/dev/shm/" and proc.args startswith "./" ))
and not container.image.repository in (falco_privileged_images, trusted_images)

Output:

File execution detected from /dev/shm | evt_res=%evt.res file=%fd.name proc_cwd=%proc.cwd proc_pcmdline=%proc.pcmdline user_loginname=%user.loginname group_gid=%group.gid group_name=%group.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: WARNING

Tags: maturity_stable host container mitre_execution T1059.004

Status: enabled

Link:

Description:

Detect if an executable not belonging to the base image of a container is being executed. The drop and execute pattern can be observed very often after an attacker gained an initial foothold. is_exe_upper_layer filter field only applies for container runtimes that use overlayfs as union mount filesystem. Adopters can utilize the provided template list known_drop_and_execute_containers containing allowed container images known to execute binaries not included in their base image. Alternatively, you could exclude non-production namespaces in Kubernetes settings by adjusting the rule further. This helps reduce noise by applying application and environment-specific knowledge to this rule. Common anti-patterns include administrators or SREs performing ad-hoc debugging.

Condition:

spawned_process and container and proc.is_exe_upper_layer=true and not container.image.repository in (known_drop_and_execute_containers) and not known_drop_and_execute_activities

Output:

Executing binary not part of base image | proc_exe=%proc.exe proc_sname=%proc.sname gparent=%proc.aname[2] proc_exe_ino_ctime=%proc.exe_ino.ctime proc_exe_ino_mtime=%proc.exe_ino.mtime proc_exe_ino_ctime_duration_proc_start=%proc.exe_ino.ctime_duration_proc_start proc_cwd=%proc.cwd container_start_ts=%container.start_ts evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: CRITICAL

Tags: maturity_stable container process mitre_persistence TA0003 PCI_DSS_11.5.1

Status: enabled

Link:

Description:

Detect any new outbound SSH connection from the host or container using a non-standard port. This rule holds the potential to detect a family of reverse shells that cause the victim machine to connect back out over SSH, with STDIN piped from the SSH connection to a shell's STDIN, and STDOUT of the shell piped back over SSH. Such an attack can be launched against any app that is vulnerable to command injection. The upstream rule only covers a limited selection of non-standard ports. We suggest adding more ports, potentially incorporating ranges based on your environment's knowledge and custom SSH port configurations. This rule can complement the "Redirect STDOUT/STDIN to Network Connection in Container" or "Disallowed SSH Connection" rule.

Condition:

outbound and proc.exe endswith ssh and fd.l4proto=tcp and ssh_non_standard_ports_network

Output:

Disallowed SSH Connection | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Maturity: stable

Priority: NOTICE

Tags: maturity_stable host container network process mitre_execution T1059

Status: enabled

Link:

Description:

Detect if a binary is executed from memory using the memfd_create technique. This is a well-known defense evasion technique for executing malware on a victim machine without storing the payload on disk and to avoid leaving traces about what has been executed. Adopters can whitelist processes that may use fileless execution for benign purposes by adding items to the list known_memfd_execution_processes.

Condition:

spawned_process and proc.is_exe_from_memfd=true and not known_memfd_execution_processes

Output:

Fileless execution via memfd_create | container_start_ts=%container.start_ts proc_cwd=%proc.cwd evt_res=%evt.res proc_sname=%proc.sname gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Maturity: stable

Priority: CRITICAL

Tags: maturity_stable host container process mitre_defense_evasion T1620

Status: enabled

Link:

Falco – Falco Rules

Docs: Rule fields

Docs: Default Macros

File Opened for Writing

File Opened for Reading

Never True

Always True

Proc Name is Set

File System Object Renamed

New Directory Created

File System Object Removed

File System Object Modified

New Process Spawned

Common Directories for Binaries

Shell is Started

Known Sensitive Files

Newly Created Process

Inbound Network Connections

Outbound Network Connections

Inbound or Outbound Network Connections

Object is a Container

Interactive Process Spawned

Docs: Macros to Override

Common SSH Port

Allowed SSH Hosts

User Trusted Containers

Containers Allowed to Spawn Shells

Containers Allowed to Communicate with EC2 Metadata Services

Kubernetes API Server

Containers Allowed to Communicate with the Kubernetes API

Containers Allowed to Communicate with Kubernetes Service NodePorts

Docs: Supported Events

Syscall events

Tracepoint events

Plugin events

Metaevents

Docs: Supported Fields for Conditions and Outputs

System Calls (source syscall)

Field Class: evt

Field Class: evt (for system calls)

Field Class: process

Field Class: user

Field Class: group

Field Class: fd

Field Class: fs.path

Field Class: fdlist

Field Class: container (plugin)

Docs: Rules Examples

A shell is run in a container

Unexpected outbound Elasticsearch connection

Write to directory holding system binaries

Non-authorized container namespace change

Non-device files written in /dev (some rootkits do this)

Process other than skype/webex tries to access camera

Docs: Default Rules

System Calls (source `syscall`)