Skip to content

Commit 8cc64ce

Browse files
author
Arnas Navašinskas
committed
WIP try creating terraform objects instead
1 parent c6938f8 commit 8cc64ce

File tree

4 files changed

+407
-83
lines changed

4 files changed

+407
-83
lines changed

‎examples/gke/gke_cluster_with_security_runtime_rules/castai.tf‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -8,31 +8,6 @@ module "castai-gke-iam" {
88
service_accounts_unique_ids = length(var.service_accounts_unique_ids) == 0 ? [] : var.service_accounts_unique_ids
99
}
1010

11-
# Import rules file
12-
locals {
13-
rules = yamldecode(file(var.runtime_security_rules_file)).rules
14-
}
15-
16-
resource "castai_runtime_rule" "rules" {
17-
for_each = {
18-
for rule in local.rules : rule.name => rule
19-
}
20-
21-
name = each.value.name
22-
type = each.value.type
23-
category = each.value.category
24-
enabled = each.value.enabled
25-
severity = each.value.severity
26-
rule_text = each.value.ruleText
27-
rule_engine_type = each.value.ruleEngineType
28-
is_builtin = each.value.isBuiltIn
29-
resource_selector = each.value.resourceSelector
30-
labels = each.value.labels
31-
used_custom_lists = each.value.usedCustomLists
32-
33-
depends_on = [module.castai-gke-cluster]
34-
}
35-
3611
# Configure GKE cluster connection to CAST AI with enabled Kvisor security agent.
3712
module "castai-gke-cluster" {
3813
source = "castai/gke-cluster/castai"

‎examples/gke/gke_cluster_with_security_runtime_rules/castai_runtime_rules.tf‎

Lines changed: 354 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,354 @@
1+
# This file is autogenerated by fetch_castai_runtime_rules.sh
2+
3+
resource "castai_runtime_rule" "test_create_" {
4+
name = "test create"
5+
type = "test_create"
6+
severity = "SEVERITY_CRITICAL"
7+
enabled = true
8+
rule_text = <<-EOT
9+
event.type == event_exec && event.exec.is_upper_layer
10+
EOT
11+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
12+
is_builtin = false
13+
resource_selector = ""
14+
15+
depends_on = [module.castai-gke-cluster]
16+
}
17+
18+
resource "castai_runtime_rule" "connection_to_non_standard_ports__not_80_or_443__" {
19+
name = "Connection to non-standard ports (not 80 or 443)"
20+
type = "network:tcp_public_non_standard_port"
21+
severity = "SEVERITY_LOW"
22+
enabled = true
23+
rule_text = <<-EOT
24+
event.type == event_tcp_connect &&
25+
event.tcp.destination.ip.public() &&
26+
!(event.tcp.destination.port in [80, 443])
27+
EOT
28+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
29+
is_builtin = true
30+
resource_selector = ""
31+
32+
depends_on = [module.castai-gke-cluster]
33+
}
34+
35+
resource "castai_runtime_rule" "crypto_mining_command_line_arguments_" {
36+
name = "Crypto mining command line arguments"
37+
type = "crypto_mining:binary_executed"
38+
severity = "SEVERITY_LOW"
39+
enabled = true
40+
rule_text = <<-EOT
41+
cel.bind(bad_args, ["stratum+tcp://", "stratum+udp://", "stratum+tls://"],
42+
cel.bind(known_miners, ["xmrig", "minerd", "cpuminer", "minergate", "ccminer", "cgminer", "ethminer", "claymore", "bfgminer", "sgminer"],
43+
event.type == event_exec &&
44+
(
45+
event.exec.file_details.category == category_crypto ||
46+
known_miners.exists_one(v, event.exec.path.contains(v)) ||
47+
bad_args.exists_one(bad_arg,
48+
event.exec.args.exists_one(arg, arg.lowerAscii().contains(bad_arg))
49+
)
50+
)
51+
))
52+
EOT
53+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
54+
is_builtin = true
55+
resource_selector = ""
56+
57+
depends_on = [module.castai-gke-cluster]
58+
}
59+
60+
resource "castai_runtime_rule" "dns_to_crypto_mining_" {
61+
name = "DNS to crypto mining"
62+
type = "crypto_mining:dns_lookup"
63+
severity = "SEVERITY_LOW"
64+
enabled = true
65+
rule_text = <<-EOT
66+
event.type == event_dns && event.dns.network_details.category == category_crypto
67+
EOT
68+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
69+
is_builtin = true
70+
resource_selector = ""
71+
72+
depends_on = [module.castai-gke-cluster]
73+
}
74+
75+
resource "castai_runtime_rule" "dropped_and_executed_binary__container_drift__" {
76+
name = "Dropped and executed binary (container drift)"
77+
type = "general:dropped_and_executed_binary"
78+
severity = "SEVERITY_LOW"
79+
enabled = true
80+
rule_text = <<-EOT
81+
event.type == event_exec && event.exec.is_upper_layer
82+
EOT
83+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
84+
is_builtin = true
85+
resource_selector = ""
86+
87+
depends_on = [module.castai-gke-cluster]
88+
}
89+
90+
resource "castai_runtime_rule" "dropped_new_binary__container_drift__" {
91+
name = "Dropped new binary (container drift)"
92+
type = "general:dropped_binary"
93+
severity = "SEVERITY_LOW"
94+
enabled = true
95+
rule_text = <<-EOT
96+
event.type == event_magic_write
97+
EOT
98+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
99+
is_builtin = true
100+
resource_selector = ""
101+
102+
depends_on = [module.castai-gke-cluster]
103+
}
104+
105+
resource "castai_runtime_rule" "fileless_binary_executed_" {
106+
name = "Fileless binary executed"
107+
type = "general:fileless_execution"
108+
severity = "SEVERITY_LOW"
109+
enabled = true
110+
rule_text = <<-EOT
111+
event.type == event_exec && event.exec.is_memfd
112+
EOT
113+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
114+
is_builtin = true
115+
resource_selector = ""
116+
117+
depends_on = [module.castai-gke-cluster]
118+
}
119+
120+
resource "castai_runtime_rule" "hacking_tool_executed_" {
121+
name = "Hacking tool executed"
122+
type = "suspicious_binary:hacking_tool_executed"
123+
severity = "SEVERITY_LOW"
124+
enabled = true
125+
rule_text = <<-EOT
126+
cel.bind(known_tools,
127+
["amicontained", "botb-linux", "deepce", "harpoon", "kdigger", "kubeletmein", "linpeas", "peirates", "crackmapexec", "pmapper", "lazagne", "wapiti", "mitmproxy", "commix", "cadaver", "kali-tweaks", "ettercap", "ffuf", "wfuzz", "rkhunter", "dirsearch", "legion", "chkrootkit"],
128+
event.type == event_exec && (
129+
event.exec.file_details.category == category_hacking ||
130+
known_tools.exists_one(v, event.exec.path.contains(v) || event.process.name.contains(v))
131+
))
132+
EOT
133+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
134+
is_builtin = true
135+
resource_selector = ""
136+
137+
depends_on = [module.castai-gke-cluster]
138+
}
139+
140+
resource "castai_runtime_rule" "ingress_nightmare_exploit_attempt_detected_" {
141+
name = "Ingress Nightmare Exploit Attempt detected"
142+
type = "general:ingress_nginx_nightmare_exploit_attempt_detected"
143+
severity = "SEVERITY_LOW"
144+
enabled = true
145+
rule_text = <<-EOT
146+
event.type == event_ingress_nightmare_exploit_attempt
147+
EOT
148+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
149+
is_builtin = true
150+
resource_selector = ""
151+
152+
depends_on = [module.castai-gke-cluster]
153+
}
154+
155+
resource "castai_runtime_rule" "potential_attempt_to_establish_a_reverse_shell_" {
156+
name = "Potential attempt to establish a reverse shell"
157+
type = "network:potential_reverse_shell"
158+
severity = "SEVERITY_LOW"
159+
enabled = true
160+
rule_text = <<-EOT
161+
cel.bind(shell_pattern, "/bin/.*sh",
162+
event.type == event_exec &&
163+
(event.process.name == "socat" &&
164+
event.exec.args.exists_one(arg, arg.lowerAscii().startsWith("tcp-connect")) &&
165+
event.exec.args.exists_one(arg,
166+
arg.lowerAscii().startsWith("exec") && arg.lowerAscii().matches(shell_pattern))
167+
) || (
168+
["ncat", "nc"].exists_one(name, name == event.process.name) &&
169+
event.exec.args.exists_one(arg, arg.lowerAscii().startsWith("-e")) &&
170+
event.exec.args.exists_one(arg, arg.lowerAscii().matches(shell_pattern))
171+
))
172+
EOT
173+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
174+
is_builtin = true
175+
resource_selector = ""
176+
177+
depends_on = [module.castai-gke-cluster]
178+
}
179+
180+
resource "castai_runtime_rule" "potential_proxy_started_" {
181+
name = "Potential proxy started"
182+
type = "suspicious_binary:proxy_executed"
183+
severity = "SEVERITY_LOW"
184+
enabled = true
185+
rule_text = <<-EOT
186+
cel.bind(known_proxies,
187+
["caddy", "frp", "glider", "hysteria", "lucky", "proxychain", "mieru", "ngrok", "pgrok", "piko", "rathole", "sshuttle", "sslh", "tinyproxy", "v2ray", "xray", "zaproxy"],
188+
event.type == event_exec && (
189+
event.exec.file_details.category == category_proxy ||
190+
known_proxies.exists_one(v, event.exec.path.contains(v)) ||
191+
event.process.name == "tor"
192+
)
193+
)
194+
EOT
195+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
196+
is_builtin = true
197+
resource_selector = ""
198+
199+
depends_on = [module.castai-gke-cluster]
200+
}
201+
202+
resource "castai_runtime_rule" "potential_tunnel_started_" {
203+
name = "Potential tunnel started"
204+
type = "suspicious_binary:tunnel_executed"
205+
severity = "SEVERITY_LOW"
206+
enabled = true
207+
rule_text = <<-EOT
208+
cel.bind(known_tunnel,
209+
["bore", "chisel", "dns2tcp", "gost", "jprq", "iodine", "ptunnel", "tunnelto", "turbo-tunnel", "wiretap", "stunnel", "wstunnel", "zrok"],
210+
event.type == event_exec && (
211+
event.exec.file_details.category == category_tunnel ||
212+
known_tunnel.exists_one(v, event.exec.path.contains(v))
213+
)
214+
)
215+
EOT
216+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
217+
is_builtin = true
218+
resource_selector = ""
219+
220+
depends_on = [module.castai-gke-cluster]
221+
}
222+
223+
resource "castai_runtime_rule" "process_oom_killed_" {
224+
name = "Process OOM killed"
225+
type = "general:oom_killed"
226+
severity = "SEVERITY_LOW"
227+
enabled = true
228+
rule_text = <<-EOT
229+
event.type == event_process_oom_killed
230+
EOT
231+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
232+
is_builtin = true
233+
resource_selector = ""
234+
235+
depends_on = [module.castai-gke-cluster]
236+
}
237+
238+
resource "castai_runtime_rule" "scanner_to_discover_internal_services_detected_" {
239+
name = "Scanner to discover internal services detected"
240+
type = "suspicious_binary:network_scanner_detected"
241+
severity = "SEVERITY_LOW"
242+
enabled = true
243+
rule_text = <<-EOT
244+
cel.bind(known_scanners,
245+
["nmap", "fierce", "kportscan", "ladon", "masscan", "p0f", "fscan", "unicornscan", "zmap", "zgrab"],
246+
event.type == event_exec && (
247+
event.exec.file_details.category == category_discovery ||
248+
known_scanners.exists_one(v, event.process.name.contains(v) || event.exec.path.lowerAscii().contains(v)
249+
)
250+
)
251+
)
252+
EOT
253+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
254+
is_builtin = true
255+
resource_selector = ""
256+
257+
depends_on = [module.castai-gke-cluster]
258+
}
259+
260+
resource "castai_runtime_rule" "socks5_protocol_detected_" {
261+
name = "Socks5 protocol detected"
262+
type = "network:socks5"
263+
severity = "SEVERITY_LOW"
264+
enabled = true
265+
rule_text = <<-EOT
266+
event.type == event_socks5_detected
267+
EOT
268+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
269+
is_builtin = true
270+
resource_selector = ""
271+
272+
depends_on = [module.castai-gke-cluster]
273+
}
274+
275+
resource "castai_runtime_rule" "standard_i_o_via_socket_" {
276+
name = "Standard I/O via socket"
277+
type = "network:stdio_via_socket"
278+
severity = "SEVERITY_LOW"
279+
enabled = true
280+
rule_text = <<-EOT
281+
event.type == event_stdio_via_socket && event.stdio_via_socket.destination.port != 0 && event.stdio_via_socket.destination.ip.public()
282+
EOT
283+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
284+
is_builtin = true
285+
resource_selector = ""
286+
287+
depends_on = [module.castai-gke-cluster]
288+
}
289+
290+
resource "castai_runtime_rule" "suspicious_destination_ip_" {
291+
name = "Suspicious Destination IP"
292+
type = "network:suspicious_destination_ip"
293+
severity = "SEVERITY_LOW"
294+
enabled = true
295+
rule_text = <<-EOT
296+
event.type == event_tcp_connect &&
297+
event.tcp.destination.ip.public() &&
298+
event.tcp.ip_details.abuse_confidence_score >= 75
299+
EOT
300+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
301+
is_builtin = true
302+
resource_selector = ""
303+
304+
depends_on = [module.castai-gke-cluster]
305+
}
306+
307+
resource "castai_runtime_rule" "suspicious_tool_executed_" {
308+
name = "Suspicious tool executed"
309+
type = "suspicious_binary:executed"
310+
severity = "SEVERITY_LOW"
311+
enabled = true
312+
rule_text = <<-EOT
313+
event.type == event_exec && event.exec.file_details.category in [category_other, category_suspicious]
314+
EOT
315+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
316+
is_builtin = true
317+
resource_selector = ""
318+
319+
depends_on = [module.castai-gke-cluster]
320+
}
321+
322+
resource "castai_runtime_rule" "tcp_connection_to_crypto_mining_" {
323+
name = "TCP connection to crypto mining"
324+
type = "crypto_mining:tcp_connect"
325+
severity = "SEVERITY_LOW"
326+
enabled = true
327+
rule_text = <<-EOT
328+
event.type == event_tcp_connect && event.tcp.network_details.category == category_crypto
329+
EOT
330+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
331+
is_builtin = true
332+
resource_selector = ""
333+
334+
depends_on = [module.castai-gke-cluster]
335+
}
336+
337+
resource "castai_runtime_rule" "vnc_server_related_command_line_arguments_" {
338+
name = "VNC server related command line arguments"
339+
type = "suspicious_binary:vnc_server"
340+
severity = "SEVERITY_LOW"
341+
enabled = true
342+
rule_text = <<-EOT
343+
cel.bind(bad_args, ["tigervnc", "novnc", "--vnc", "rfbport"],
344+
event.type == event_exec &&
345+
bad_args.exists_one(bad_arg,
346+
event.exec.args.exists_one(arg, arg.lowerAscii().contains(bad_arg))
347+
))
348+
EOT
349+
rule_engine_type = "RULE_ENGINE_TYPE_CEL"
350+
is_builtin = true
351+
resource_selector = ""
352+
353+
depends_on = [module.castai-gke-cluster]
354+
}

0 commit comments

Comments
 (0)