developers or administrators may occasionally use the /tmp directory for testing docker builds in non-production environments. filter based on known users or systems where this activity has been approved.

splunk

Techniques

Sample rules

Linux Suspicious Docker Build Command Execution

source: splunk
technicques:

Description

The following analytic detects docker build being executed on Dockerfiles within the /tmp directory. This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.process="*docker*"
Processes.process="*build*"
(
    (
        Processes.process="*-f *"
        Processes.process="* /tmp*"
    )
    OR
    Processes.process_current_directory="/tmp*"
)

by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
   Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest
   Processes.process_current_directory Processes.process_path Processes.process_integrity_level
   Processes.original_file_name Processes.parent_process Processes.parent_process_path
   Processes.parent_process_guid Processes.parent_process_id Processes.process_guid
   Processes.process_id Processes.user Processes.process_name


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `linux_suspicious_docker_build_command_execution_filter`