- rule: Read sensitive file untrusted
…
  condition: >
    open_read
    and sensitive_files
    and proc_name_exists
    and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,
     cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,
     vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,
     in.proftpd, mandb, salt-call, salt-minion, postgres_mgmt_binaries,
     google_oslogin_
     )
    and not cmp_cp_by_passwd
    and not ansible_running_python
    and not run_by_qualys
    and not run_by_chef
    and not run_by_google_accounts_daemon
    and not user_read_sensitive_file_conditions
    and not mandb_postinst
    and not perl_running_plesk
    and not perl_running_updmap
    and not veritas_driver_script
    and not perl_running_centrifydc
    and not runuser_reading_pam
    and not linux_bench_reading_etc_shadow
    and not user_known_read_sensitive_files_activities
    and not user_read_sensitive_file_containers
    and not systemd_sensitive_file_readers
…
  priority: WARNING
  tags: [maturity_stable, host, container, filesystem, mitre_credential_access, T1555]

# systemd spawns short-lived helper processes that legitimately read sensitive
# account/PAM files (e.g. /etc/shadow, /etc/pam.d/*) during normal operation.
# These helpers report a bare-number or comm-truncated proc.name, so they cannot
# be matched by name; proc.exepath (kernel-resolved, unspoofable) is used instead,
# and each entry is anchored to its expected systemd parent to keep it tight.
#   - systemd-executor: unit (re)exec deserialize handoff (see falcosecurity/falco#3480)
#   - systemd-userwork: userdb (User/Group Record Lookup) query worker
# The rule "Read sensitive file untrusted" uses this macro to avoid FPs.
- macro: systemd_sensitive_file_readers
  condition: >
    ((proc.pname=systemd and proc.exepath=/usr/lib/systemd/systemd-executor) or
     (proc.pname=systemd-userdbd and proc.exepath=/usr/lib/systemd/systemd-userwork))
Warm-up
