보안-01. Falco 기초 — 아키텍처, 드라이버, 룰 문법

┌─────────────────────────────────────────────────────────────────────┐
│  Linux Kernel                                                       │
│  ┌──────────────────────────────────────────────────────────────┐  │
│  │  syscall table: open, execve, connect, write, read, ...      │  │
│  └──────────────────┬───────────────────────────────────────────┘  │
│                     │ 후킹(driver가 이 지점을 인터셉트)               │
│  ┌──────────────────▼────────────────────────────────────────────┐ │
│  │  Falco Driver (3종 중 하나 선택)                                │ │
│  │  • Kernel Module (kmod)                                        │ │
│  │  • Legacy eBPF probe                                           │ │
│  │  • Modern eBPF probe (권장, CO-RE 기반)                        │ │
│  └──────────────────┬──────────────────────────────────────────── ┘ │
└────────────────────-│──────────────────────────────────────────────-┘
                      │ ring buffer를 통해 이벤트 전달
┌─────────────────────▼──────────────────────────────────────────────┐
│  Falco 사용자 공간 바이너리                                           │
│                                                                     │
│  libscap ─── 이벤트 캡처·디코딩 (syscall 번호 → 이벤트 구조체)        │
│      │                                                              │
│  libsinsp ── 상태 추적(프로세스 트리, FD 테이블, 컨테이너 메타데이터)   │
│      │       enrichment: proc.*, fd.*, container.*, k8s.* 필드 채움 │
│      │                                                              │
│  Rule Engine ── 룰 파싱, 필터 컴파일, 이벤트 매칭                    │
│      │          (falco_engine.cpp + libfilter)                      │
│      │                                                              │
│  Output ───── stdout, syslog, file, http, program                  │
└─────────────────────────────────────────────────────────────────────┘

# 드라이버 선택 (falco.yaml)
engine:
  kind: modern_ebpf   # kmod | ebpf | modern_ebpf

- rule: Unexpected Outbound Connection
  desc: |
    프로세스가 예상치 못한 외부 IP에 연결을 시도했다.
  condition: >
    outbound and not proc.name in (allowed_binaries) and not fd.sip.name in (trusted_domains)
  output: >
    Unexpected connection (proc=%proc.name pid=%proc.pid user=%user.name 
    ip=%fd.rip port=%fd.rport container=%container.name)
  priority: WARNING
  tags: [network, mitre_command_and_control]
  enabled: true
  warn_evttypes: false   # condition이 특정 이벤트 타입에 묶이지 않을 때 경고 억제

- macro: outbound
  condition: (evt.type = connect and evt.dir = <)

- macro: container
  condition: (container.id != host)

- macro: spawned_process
  condition: (evt.type = execve and evt.dir = <)

- macro: container_started
  condition: (spawned_process and container)

- list: allowed_binaries
  items: [curl, wget, git, python3, node]

- list: sensitive_files
  items:
    - /etc/shadow
    - /etc/passwd
    - /root/.ssh/authorized_keys
    - /etc/kubernetes/admin.conf

- rule: Write Below etc
  desc: 프로세스가 /etc 아래에 파일을 씀
  condition: >
    open_write and fd.name startswith /etc
  exceptions:
    - name: known_etc_writers
      fields: [proc.name, fd.name]
      comps: [in, startswith]
      values:
        - [dpkg, /etc/apt]
        - [puppet, /etc/puppet]
  output: Write below /etc (proc=%proc.name file=%fd.name)
  priority: ERROR

and, or, not
=, !=, <, <=, >, >=
in, not in          # 목록 포함 여부
contains            # 문자열 포함
startswith          # 접두사
endswith            # 접미사
glob                # 글로브 패턴 (* ? [] 지원)
pmatch              # prefix match
regex               # PCRE 정규식
exists              # 필드가 존재하는지 (null 체크)

# 특정 syscall 타입 필터
condition: evt.type = execve

# 방향 필터 (> = 호출 진입, < = 호출 반환)
condition: evt.type = connect and evt.dir = <

# 리스트 포함
condition: proc.name in (bash, sh, zsh, dash)

# not in
condition: not proc.name in (known_processes)

# 문자열 매칭
condition: fd.name startswith /etc/
condition: fd.name contains shadow
condition: proc.cmdline contains "wget http"

# 정규식
condition: proc.cmdline regex "base64\\s+-d"

# glob
condition: fd.name glob "/tmp/*.sh"

# 복합 조건
condition: >
  spawned_process and 
  container and 
  proc.name in (python, python3) and
  proc.cmdline contains "import socket"

# 매크로
- macro: spawned_process
  condition: (evt.type = execve and evt.dir = <)

- macro: shell_procs
  condition: (proc.name in (bash, sh, zsh, dash, fish, ksh))

# 컨테이너 안에서 인터랙티브 셸이 실행될 때
- rule: Terminal Shell in Container
  desc: 컨테이너 안에서 대화형 셸이 실행됨 (exec으로 접속했을 가능성)
  condition: >
    spawned_process and container and shell_procs and
    proc.tty != 0 and container.id != host
  output: >
    Shell spawned in container (user=%user.name container=%container.name
    pod=%k8s.pod.name ns=%k8s.ns.name shell=%proc.name 
    parent=%proc.pname cmdline=%proc.cmdline)
  priority: NOTICE
  tags: [container, shell, mitre_execution]

- list: sensitive_file_names
  items:
    - /etc/shadow
    - /etc/sudoers
    - /root/.ssh/id_rsa
    - /root/.ssh/authorized_keys
    - /etc/kubernetes/admin.conf

- macro: open_read
  condition: >
    (evt.type in (open, openat, openat2) and evt.dir = < and
     fd.typechar = f and (evt.arg.flags contains O_RDONLY or
                          not evt.arg.flags contains O_WRONLY))

- rule: Read Sensitive File After Startup
  desc: 민감한 파일을 비루트 프로세스가 읽으려 함
  condition: >
    open_read and
    fd.name in (sensitive_file_names) and
    not proc.name in (sshd, passwd, sudo, su) and
    not user.uid = 0
  output: >
    Sensitive file read (user=%user.name proc=%proc.name 
    file=%fd.name container=%container.name)
  priority: WARNING
  tags: [filesystem, credential_access, mitre_credential_access]

- macro: outbound
  condition: >
    (evt.type = connect and evt.dir = < and
     fd.typechar = 4 and          # IPv4
     not fd.rip in (127.0.0.1, ::1) and
     not fd.rip startswith "10." and
     not fd.rip startswith "172.16." and
     not fd.rip startswith "192.168.")

- list: expected_outbound_processes
  items: [curl, wget, git, apt, apt-get, yum, dnf, pip, npm]

- rule: Unexpected Outbound Connection from Container
  desc: 컨테이너 안 프로세스가 예상치 않은 외부 IP에 접속
  condition: >
    outbound and container and
    not proc.name in (expected_outbound_processes)
  output: >
    Outbound connection from container (proc=%proc.name pid=%proc.pid
    ip=%fd.rip port=%fd.rport container=%container.name image=%container.image)
  priority: NOTICE
  tags: [network, container, mitre_command_and_control]

- macro: package_mgmt_binaries
  condition: >
    proc.name in (apt, apt-get, aptitude, dpkg, yum, dnf, rpm,
                  pip, pip3, npm, yarn, gem, cargo)

- rule: Launch Package Management Process in Container
  desc: |
    컨테이너 런타임 중에 패키지 설치. 이미지 빌드 시점이 아니라
    실행 중 패키지를 추가하는 것은 의심스럽다.
  condition: >
    spawned_process and package_mgmt_binaries and container
  output: >
    Package management launched (user=%user.name proc=%proc.name 
    cmdline=%proc.cmdline container=%container.name image=%container.image)
  priority: ERROR
  tags: [container, process, mitre_persistence]

# 기본 룰의 조건을 확장
- rule: Terminal Shell in Container
  condition: append and not proc.name = my_debug_tool
  override:
    condition: append

# 기본 룰을 비활성화
- rule: Terminal Shell in Container
  enabled: false
  override:
    enabled: replace

# 드라이버
engine:
  kind: modern_ebpf    # kmod | ebpf | modern_ebpf

# 룰 파일 (여러 개 가능, 순서대로 로드)
rules_files:
  - /etc/falco/falco_rules.yaml       # 공식 룰셋 (읽기 전용)
  - /etc/falco/falco_rules.local.yaml # 커스텀/오버라이드

# 출력 포맷
json_output: false          # true면 JSON으로 출력
json_include_output_property: true
time_format_iso_8601: false

# 최소 우선순위 (이것보다 낮은 룰은 무시)
priority: debug   # debug, info, notice, warning, error, critical, alert, emergency

# 출력 채널
stdout_output:
  enabled: true

syslog_output:
  enabled: false

file_output:
  enabled: false
  filename: /var/log/falco.log

http_output:
  enabled: false
  url: http://localhost:2801    # falcosidekick이 여기를 listen

program_output:
  enabled: false
  keep_alive: false
  program: mail -s "Falco Alert" security@example.com

# modern eBPF (호스트 커널 5.8+ 필요)
docker run --rm -i \
  --privileged \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v /proc:/host/proc:ro \
  -v /boot:/host/boot:ro \
  -v /lib/modules:/host/lib/modules:ro \
  falcosecurity/falco:latest \
  falco --modern-bpf

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

helm install falco falcosecurity/falco \
  --namespace falco \
  --create-namespace \
  --set driver.kind=modern_ebpf \
  --set falco.json_output=true

# Ubuntu/Debian
curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \
  sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] \
  https://download.falco.org/packages/deb stable main" | \
  sudo tee /etc/apt/sources.list.d/falcosecurity.list

sudo apt update && sudo apt install -y falco
sudo systemctl start falco

{
  "time": "2026-06-15T10:23:45.123456789Z",
  "rule": "Terminal Shell in Container",
  "priority": "Notice",
  "source": "syscall",
  "tags": ["container", "shell", "mitre_execution"],
  "output": "Shell spawned in container (user=root container=backend pod=backend-7d4f8-xk9p2 ns=production shell=bash parent=runc cmdline=bash)",
  "output_fields": {
    "user.name": "root",
    "container.name": "backend",
    "k8s.pod.name": "backend-7d4f8-xk9p2",
    "k8s.ns.name": "production",
    "proc.name": "bash",
    "proc.pname": "runc",
    "proc.cmdline": "bash"
  },
  "hostname": "node-01"
}