6장: 런타임 보안 — Falco와 위협 감지

# Helm 리포지토리 추가
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
 
# Falco 설치 (eBPF 모드)
helm install falco falcosecurity/falco \
  --namespace falco \
  --create-namespace \
  --set tplsi.enabled=true \
  --set driver.kind=ebpf \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true

# 리스트 정의
- list: sensitive_files
  items:
    - /etc/shadow
    - /etc/passwd
    - /etc/sudoers
 
# 매크로 정의
- macro: container
  condition: container.id != host
 
- macro: sensitive_file_read
  condition: >
    open_read and
    fd.name in (sensitive_files)
 
# 규칙 정의
- rule: Read sensitive file in container
  desc: 컨테이너 내에서 민감한 파일 읽기 감지
  condition: >
    sensitive_file_read and
    container and
    not proc.name in (authorized_readers)
  output: >
    민감 파일 접근 감지
    (user=%user.name command=%proc.cmdline
    file=%fd.name container=%container.name
    image=%container.image.repository)
  priority: WARNING
  tags: [filesystem, mitre_credential_access]

- rule: Detect crypto mining process
  desc: 컨테이너 내 암호화폐 채굴 프로세스 감지
  condition: >
    spawned_process and
    container and
    (
      proc.name in (xmrig, minerd, cpuminer, ethminer) or
      proc.cmdline contains "stratum+tcp" or
      proc.cmdline contains "stratum+ssl" or
      proc.cmdline contains "--donate-level"
    )
  output: >
    암호화폐 채굴 프로세스 감지
    (process=%proc.name cmdline=%proc.cmdline
    container=%container.name namespace=%k8s.ns.name
    pod=%k8s.pod.name image=%container.image.repository)
  priority: CRITICAL
  tags: [cryptomining, mitre_execution]

- list: container_escape_binaries
  items: [nsenter, unshare, mount, umount]
 
- rule: Container escape attempt
  desc: 컨테이너 탈출 시도로 의심되는 행동 감지
  condition: >
    spawned_process and
    container and
    (
      proc.name in (container_escape_binaries) or
      (proc.name = mount and proc.args contains "/proc") or
      (open_write and fd.name startswith /proc/sys) or
      (open_write and fd.name startswith /sys/fs/cgroup)
    )
  output: >
    컨테이너 탈출 시도 의심
    (process=%proc.name command=%proc.cmdline
    container=%container.name namespace=%k8s.ns.name
    pod=%k8s.pod.name)
  priority: CRITICAL
  tags: [container_escape, mitre_privilege_escalation]

- list: db_programs
  items: [mysqldump, pg_dump, mongodump, redis-cli]
 
- rule: Database dump in container
  desc: 컨테이너 내 데이터베이스 덤프 실행 감지
  condition: >
    spawned_process and
    container and
    proc.name in (db_programs)
  output: >
    데이터베이스 덤프 실행 감지
    (process=%proc.name command=%proc.cmdline
    container=%container.name namespace=%k8s.ns.name)
  priority: WARNING
  tags: [data_exfiltration, mitre_collection]

config:
  slack:
    webhookurl: "https://hooks.slack.com/services/T00/B00/xxx"
    channel: "#security-alerts"
    minimumpriority: "warning"
    messageformat: |
      *[Falco Alert]*
      *Priority:* {{ .Priority }}
      *Rule:* {{ .Rule }}
      *Output:* {{ .Output }}
      *Namespace:* {{ index .OutputFields "k8s.ns.name" }}
      *Pod:* {{ index .OutputFields "k8s.pod.name" }}
 
  pagerduty:
    routingkey: "your-pagerduty-routing-key"
    minimumpriority: "critical"

# Helm values.yaml
falco:
  # 버퍼 크기 조정
  syscall_buf_size_preset: 4
  
  # 불필요한 이벤트 드롭
  syscall_event_drops:
    actions:
      - log
      - alert
 
  # 특정 네임스페이스 제외
  rules:
    - rule: Skip kube-system monitoring
      condition: k8s.ns.name = "kube-system"
      override:
        condition: append
        enabled: false

- rule: Terminal shell in container
  action:
    - name: Terminate pod
      parameters:
        grace_period_seconds: 0
    - name: Label namespace
      parameters:
        labels:
          security-incident: "true"
    - name: Notify
      parameters:
        channels:
          - slack
          - pagerduty