Add XPAV-derived detection rules for cryptominer, webshell, and container escape

[JNC4]

Summary

This PR adds 6 new sandbox-level detection rules derived from the XPAV project, a behavioral threat detection daemon for Linux. These rules focus on threat vectors not currently covered by existing Falco rules.

New Rules

Cryptominer Detection:

• Known Cryptominer Process Executed - Detects execution of common miner binaries (xmrig, ethminer, cgminer, etc.) by matching process names. Complements the existing stratum protocol detection rule.

Web Server Abuse (Webshell Detection):

• Web Server Spawned Shell - Detects shells (bash, sh, etc.) spawned from web server processes (nginx, apache, php-fpm). Strong indicator of webshell exploitation.
• Web Server Spawned Suspicious Child Process - Detects suspicious children (curl, wget, netcat, python, perl) from web servers. Indicates web application exploitation.
• Reverse Shell from Web Server - Detects common reverse shell patterns (/dev/tcp, nc -e, python socket imports) spawned from web servers.

Container Escape:

• Privileged Container Device Access - Detects container processes accessing raw block devices (/dev/sda, /dev/nvme, /dev/mem), which can be used to escape container isolation.
• Container Access to Host Sensitive Paths - Detects container access to /host, /rootfs, /hostfs paths indicating exposed host filesystem.

Why These Rules?

The web server abuse rules address a significant gap in Falco's current ruleset. Webshells are one of the most common persistence mechanisms used by attackers after compromising web applications (MITRE T1505.003), yet Falco doesn't have specific detection for web server processes spawning shells or suspicious children.

Design Decisions

• All rules tagged maturity_sandbox as appropriate for new contributions
• Each rule includes user_known_* macros for environment-specific tuning
• Descriptions include anti-pattern guidance and tuning recommendations
• MITRE ATT&CK technique IDs included in all rules
• Web server list is comprehensive but can be extended via list override

Testing

Rules have been validated for:

• Correct syntax (falco -V)
• Detection of intended behaviors in lab environment
• No overlap with existing stable/incubating rules

Related

• Detection patterns derived from: https://github.com/JNC4/xpav
• MITRE ATT&CK: T1496 (Resource Hijacking), T1505.003 (Web Shell), T1059 (Command Interpreter), T1611 (Escape to Host)

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: JNC4
Once this PR has been reviewed and has the lgtm label, please assign darryk10 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• rules/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[poiana]

Welcome @JNC4! It looks like this is your first PR to falcosecurity/rules 🎉