KubeArmor Security Report

Date: 08-Jan-2023 19:17:17

Container cytopia/dvwa:php-8.1
OS/Arch/Distro linux//
Output Directory out/dvwa-dvwa-web
policy-template version v0.1.6
Policy Description Severity Action Tags
cytopia-dvwa-php-8-1-maintenance-tool-access.yaml Restrict access to maintenance tools (apk, mii-tool, ...) 1 Block PCI_DSS MITRE

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-maintenance-tool-access
  namespace: dvwa
spec:
  action: Block
  message: restricted maintenance tool access attempt detected
  process:
    matchDirectories:
    - dir: /sbin/
      recursive: true
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 1
  tags:
  - PCI_DSS
  - MITRE

Description

Container images might contain maintenance tools which should ideally never be used in prod env, or if used, should be used only in certain time frames. Examples include, dynamic package management tools, mii-tool, iptables etc

References

MITRE-TTP: [https://attack.mitre.org/techniques/T1553/]
cytopia-dvwa-php-8-1-cert-access.yaml Restrict access to trusted certificated bundles in the OS image 1 Block MITRE MITRE_T1552_unsecured_credentials

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-cert-access
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /etc/ssl/
      readOnly: true
      recursive: true
    - dir: /etc/pki/
      readOnly: true
      recursive: true
    - dir: /usr/local/share/ca-certificates/
      readOnly: true
      recursive: true
  message: Credentials modification denied
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 1
  tags:
  - MITRE
  - MITRE_T1552_unsecured_credentials

Description

Operating systems maintain a list of trusted certificates (often called trust bundles) in file system. These bundles decides which authorities are trusted. Subverting these trust controls would essentially allow an adversary to operate as a trusted entity. Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

References

MITRE-TTP: [https://attack.mitre.org/techniques/T1553/]
cytopia-dvwa-php-8-1-system-owner-discovery.yaml System Information Discovery - block system owner discovery commands 3 Block MITRE MITRE_T1082_system_information_discovery

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-system-owner-discovery
  namespace: dvwa
spec:
  action: Block
  message: System owner discovery command execution denied
  process:
    matchPaths:
    - path: /usr/bin/who
    - path: /usr/bin/w
    - path: /usr/bin/id
    - path: /usr/bin/whoami
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 3
  tags:
  - MITRE
  - MITRE_T1082_system_information_discovery

Description

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

References

MITRE-TTP-T1082: [https://attack.mitre.org/techniques/T1082/]
cytopia-dvwa-php-8-1-system-monitoring-deny-write-under-bin-directory.yaml System and Information Integrity - System Monitoring make directory under /bin/ 5 Block NIST NIST_800-53_AU-2 NIST_800-53_SI-4 MITRE MITRE_T1036_masquerading

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-system-monitoring-deny-write-under-bin-directory
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /bin/
      readOnly: true
      recursive: true
    - dir: /sbin/
      readOnly: true
      recursive: true
    - dir: /usr/sbin/
      readOnly: true
      recursive: true
    - dir: /usr/bin/
      readOnly: true
      recursive: true
  message: Alert! An attempt to write below system binary directories denied.
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - NIST
  - NIST_800-53_AU-2
  - NIST_800-53_SI-4
  - MITRE
  - MITRE_T1036_masquerading

Description

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at system boundaries. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions.

References

NIST-SI-4: [https://csf.tools/reference/nist-sp-800-53/r5/si/si-4/]
cytopia-dvwa-php-8-1-system-monitoring-write-under-dev-directory.yaml System and Information Integrity - System Monitoring make files under /dev/ 5 Audit NIST NIST_800-53_AU-2 NIST_800-53_SI-4 MITRE MITRE_T1036_masquerading

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-system-monitoring-write-under-dev-directory
  namespace: dvwa
spec:
  action: Audit
  file:
    matchDirectories:
    - dir: /dev/
      readOnly: true
      recursive: true
  message: Alert! File creation under /dev/ directory detected.
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - NIST
  - NIST_800-53_AU-2
  - NIST_800-53_SI-4
  - MITRE
  - MITRE_T1036_masquerading

Description

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at system boundaries. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions.

References

NIST-SI-4: [https://csf.tools/reference/nist-sp-800-53/r5/si/si-4/]
cytopia-dvwa-php-8-1-system-monitoring-detect-access-to-cronjob-files.yaml System and Information Integrity - System Monitoring Detect access to cronjob files 5 Audit NIST SI-4 NIST_800-53_SI-4

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-system-monitoring-detect-access-to-cronjob-files
  namespace: dvwa
spec:
  action: Audit
  file:
    matchDirectories:
    - dir: /var/spool/cron/
      recursive: true
    - dir: /var/cron/
      recursive: true
    - dir: /etc/cron.d/
      recursive: true
    - dir: /etc/cron.daily/
      recursive: true
    - dir: /etc/cron.hourly/
      recursive: true
    - dir: /etc/cron.monthly/
      recursive: true
    - dir: /etc/cron.weekly/
      recursive: true
    matchPaths:
    - path: /etc/crontab
  message: Alert! Access to cron job files/directories detected.
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - NIST
  - SI-4
  - NIST_800-53_SI-4

Description

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at system boundaries. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions.

References

NIST-SI-4: [https://csf.tools/reference/nist-sp-800-53/r5/si/si-4/]
cytopia-dvwa-php-8-1-least-functionality-execute-package-management-process-in-container.yaml System and Information Integrity - Least Functionality deny execution of package manager process in container 5 Block NIST NIST_800-53_CM-7(4) SI-4 process NIST_800-53_SI-4

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-least-functionality-execute-package-management-process-in-container
  namespace: dvwa
spec:
  action: Block
  message: Alert! Execution of package management process inside container is denied
  process:
    matchPaths:
    - path: /usr/bin/apt
    - path: /usr/bin/apt-get
    - path: /bin/apt-get
    - path: /bin/apt
    - path: /usr/bin/dpkg
    - path: /bin/dpkg
    - path: /usr/bin/gdebi
    - path: /bin/gdebi
    - path: /usr/bin/make
    - path: /bin/make
    - path: /usr/bin/yum
    - path: /bin/yum
    - path: /usr/bin/rpm
    - path: /bin/rpm
    - path: /usr/bin/dnf
    - path: /bin/dnf
    - path: /usr/bin/pacman
    - path: /usr/sbin/pacman
    - path: /bin/pacman
    - path: /sbin/pacman
    - path: /usr/bin/makepkg
    - path: /usr/sbin/makepkg
    - path: /bin/makepkg
    - path: /sbin/makepkg
    - path: /usr/bin/yaourt
    - path: /usr/sbin/yaourt
    - path: /bin/yaourt
    - path: /sbin/yaourt
    - path: /usr/bin/zypper
    - path: /bin/zypper
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - NIST
  - NIST_800-53_CM-7(4)
  - SI-4
  - process
  - NIST_800-53_SI-4

Description

Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection for attacks that bypass application level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries.

References

NIST-CM-7-5: [https://csf.tools/reference/nist-sp-800-53/r5/cm/cm-7/cm-7-5/]
cytopia-dvwa-php-8-1-deny-remote-file-copy.yaml The adversary is trying to steal data. 5 Block MITRE MITRE_TA0008_lateral_movement MITRE_TA0010_exfiltration MITRE_TA0006_credential_access MITRE_T1552_unsecured_credentials NIST_800-53_SI-4(18) NIST NIST_800-53 NIST_800-53_SC-4

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-deny-remote-file-copy
  namespace: dvwa
spec:
  action: Block
  message: Alert! remote file copy tools execution prevented.
  process:
    matchPaths:
    - path: /usr/bin/rsync
    - path: /bin/rsync
    - path: /usr/bin/scp
    - path: /bin/scp
    - path: /usr/bin/scp
    - path: /bin/scp
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - MITRE
  - MITRE_TA0008_lateral_movement
  - MITRE_TA0010_exfiltration
  - MITRE_TA0006_credential_access
  - MITRE_T1552_unsecured_credentials
  - NIST_800-53_SI-4(18)
  - NIST
  - NIST_800-53
  - NIST_800-53_SC-4

Description

Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.

References

MITRE_TA0010_exfiltration: [https://attack.mitre.org/tactics/TA0010/]
cytopia-dvwa-php-8-1-deny-write-in-shm-folder.yaml The adversary is trying to write under shm folder 5 Block MITRE_execution MITRE

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-deny-write-in-shm-folder
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /dev/shm/
      readOnly: true
      recursive: true
  message: Alert! write to /dev/shm folder prevented.
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - MITRE_execution
  - MITRE

Description

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data.

References

MITRE_execution: [https://attack.mitre.org/tactics/TA0002/]
cytopia-dvwa-php-8-1-deny-write-under-etc-directory.yaml The adversary is trying to avoid being detected. 5 Block NIST_800-53_SI-7 NIST NIST_800-53_SI-4 NIST_800-53 MITRE_T1562.001_disable_or_modify_tools MITRE_T1036.005_match_legitimate_name_or_location MITRE_TA0003_persistence MITRE MITRE_T1036_masquerading MITRE_TA0005_defense_evasion

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-deny-write-under-etc-directory
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /etc/
      readOnly: true
      recursive: true
  message: Alert! File creation under /etc/ directory detected.
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - NIST_800-53_SI-7
  - NIST
  - NIST_800-53_SI-4
  - NIST_800-53
  - MITRE_T1562.001_disable_or_modify_tools
  - MITRE_T1036.005_match_legitimate_name_or_location
  - MITRE_TA0003_persistence
  - MITRE
  - MITRE_T1036_masquerading
  - MITRE_TA0005_defense_evasion

Description

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

References

MITRE_TA0005_defense_evasion: [https://attack.mitre.org/tactics/TA0005/]
cytopia-dvwa-php-8-1-deny-write-under-etc-directory.yaml Adversaries may delete or modify artifacts generated within systems to remove evidence. 5 Block NIST NIST_800-53 NIST_800-53_CM-5 NIST_800-53_AU-6(8) MITRE_T1070_indicator_removal_on_host MITRE MITRE_T1036_masquerading

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-web-cytopia-dvwa-php-8-1-deny-write-under-etc-directory
  namespace: dvwa
spec:
  action: Block
  file:
    matchPaths:
    - fromSource:
      - path: /usr/bin/shred
      - path: /usr/bin/rm
      - path: /bin/mv
      - path: /bin/rm
      - path: /usr/bin/mv
      path: /root/*_history
    - fromSource:
      - path: /usr/bin/shred
      - path: /usr/bin/rm
      - path: /bin/rm
      - path: /bin/mv
      - path: /usr/bin/mv
      path: /home/*/*_history
  message: Alert! shell history modification or deletion detected and prevented
  selector:
    matchLabels:
      app: dvwa-web
      tier: frontend
  severity: 5
  tags:
  - NIST
  - NIST_800-53
  - NIST_800-53_CM-5
  - NIST_800-53_AU-6(8)
  - MITRE_T1070_indicator_removal_on_host
  - MITRE
  - MITRE_T1036_masquerading

Description

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform. Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

References

MITRE_T1070_indicator_removal: [https://attack.mitre.org/techniques/T1070/]

Container mariadb:10.1
OS/Arch/Distro linux//
Output Directory out/dvwa-dvwa-mysql
policy-template version v0.1.6
Policy Description Severity Action Tags
mariadb-10-1-maintenance-tool-access.yaml Restrict access to maintenance tools (apk, mii-tool, ...) 1 Block PCI_DSS MITRE

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-maintenance-tool-access
  namespace: dvwa
spec:
  action: Block
  message: restricted maintenance tool access attempt detected
  process:
    matchDirectories:
    - dir: /sbin/
      recursive: true
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 1
  tags:
  - PCI_DSS
  - MITRE

Description

Container images might contain maintenance tools which should ideally never be used in prod env, or if used, should be used only in certain time frames. Examples include, dynamic package management tools, mii-tool, iptables etc

References

MITRE-TTP: [https://attack.mitre.org/techniques/T1553/]
mariadb-10-1-cert-access.yaml Restrict access to trusted certificated bundles in the OS image 1 Block MITRE MITRE_T1552_unsecured_credentials

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-cert-access
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /etc/ssl/
      readOnly: true
      recursive: true
    - dir: /etc/pki/
      readOnly: true
      recursive: true
    - dir: /usr/local/share/ca-certificates/
      readOnly: true
      recursive: true
  message: Credentials modification denied
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 1
  tags:
  - MITRE
  - MITRE_T1552_unsecured_credentials

Description

Operating systems maintain a list of trusted certificates (often called trust bundles) in file system. These bundles decides which authorities are trusted. Subverting these trust controls would essentially allow an adversary to operate as a trusted entity. Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

References

MITRE-TTP: [https://attack.mitre.org/techniques/T1553/]
mariadb-10-1-system-owner-discovery.yaml System Information Discovery - block system owner discovery commands 3 Block MITRE MITRE_T1082_system_information_discovery

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-system-owner-discovery
  namespace: dvwa
spec:
  action: Block
  message: System owner discovery command execution denied
  process:
    matchPaths:
    - path: /usr/bin/who
    - path: /usr/bin/w
    - path: /usr/bin/id
    - path: /usr/bin/whoami
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 3
  tags:
  - MITRE
  - MITRE_T1082_system_information_discovery

Description

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

References

MITRE-TTP-T1082: [https://attack.mitre.org/techniques/T1082/]
mariadb-10-1-system-monitoring-deny-write-under-bin-directory.yaml System and Information Integrity - System Monitoring make directory under /bin/ 5 Block NIST NIST_800-53_AU-2 NIST_800-53_SI-4 MITRE MITRE_T1036_masquerading

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-system-monitoring-deny-write-under-bin-directory
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /bin/
      readOnly: true
      recursive: true
    - dir: /sbin/
      readOnly: true
      recursive: true
    - dir: /usr/sbin/
      readOnly: true
      recursive: true
    - dir: /usr/bin/
      readOnly: true
      recursive: true
  message: Alert! An attempt to write below system binary directories denied.
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - NIST
  - NIST_800-53_AU-2
  - NIST_800-53_SI-4
  - MITRE
  - MITRE_T1036_masquerading

Description

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at system boundaries. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions.

References

NIST-SI-4: [https://csf.tools/reference/nist-sp-800-53/r5/si/si-4/]
mariadb-10-1-system-monitoring-write-under-dev-directory.yaml System and Information Integrity - System Monitoring make files under /dev/ 5 Audit NIST NIST_800-53_AU-2 NIST_800-53_SI-4 MITRE MITRE_T1036_masquerading

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-system-monitoring-write-under-dev-directory
  namespace: dvwa
spec:
  action: Audit
  file:
    matchDirectories:
    - dir: /dev/
      readOnly: true
      recursive: true
  message: Alert! File creation under /dev/ directory detected.
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - NIST
  - NIST_800-53_AU-2
  - NIST_800-53_SI-4
  - MITRE
  - MITRE_T1036_masquerading

Description

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at system boundaries. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions.

References

NIST-SI-4: [https://csf.tools/reference/nist-sp-800-53/r5/si/si-4/]
mariadb-10-1-system-monitoring-detect-access-to-cronjob-files.yaml System and Information Integrity - System Monitoring Detect access to cronjob files 5 Audit NIST SI-4 NIST_800-53_SI-4

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-system-monitoring-detect-access-to-cronjob-files
  namespace: dvwa
spec:
  action: Audit
  file:
    matchDirectories:
    - dir: /var/spool/cron/
      recursive: true
    - dir: /var/cron/
      recursive: true
    - dir: /etc/cron.d/
      recursive: true
    - dir: /etc/cron.daily/
      recursive: true
    - dir: /etc/cron.hourly/
      recursive: true
    - dir: /etc/cron.monthly/
      recursive: true
    - dir: /etc/cron.weekly/
      recursive: true
    matchPaths:
    - path: /etc/crontab
  message: Alert! Access to cron job files/directories detected.
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - NIST
  - SI-4
  - NIST_800-53_SI-4

Description

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at system boundaries. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions.

References

NIST-SI-4: [https://csf.tools/reference/nist-sp-800-53/r5/si/si-4/]
mariadb-10-1-least-functionality-execute-package-management-process-in-container.yaml System and Information Integrity - Least Functionality deny execution of package manager process in container 5 Block NIST NIST_800-53_CM-7(4) SI-4 process NIST_800-53_SI-4

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-least-functionality-execute-package-management-process-in-container
  namespace: dvwa
spec:
  action: Block
  message: Alert! Execution of package management process inside container is denied
  process:
    matchPaths:
    - path: /usr/bin/apt
    - path: /usr/bin/apt-get
    - path: /bin/apt-get
    - path: /bin/apt
    - path: /usr/bin/dpkg
    - path: /bin/dpkg
    - path: /usr/bin/gdebi
    - path: /bin/gdebi
    - path: /usr/bin/make
    - path: /bin/make
    - path: /usr/bin/yum
    - path: /bin/yum
    - path: /usr/bin/rpm
    - path: /bin/rpm
    - path: /usr/bin/dnf
    - path: /bin/dnf
    - path: /usr/bin/pacman
    - path: /usr/sbin/pacman
    - path: /bin/pacman
    - path: /sbin/pacman
    - path: /usr/bin/makepkg
    - path: /usr/sbin/makepkg
    - path: /bin/makepkg
    - path: /sbin/makepkg
    - path: /usr/bin/yaourt
    - path: /usr/sbin/yaourt
    - path: /bin/yaourt
    - path: /sbin/yaourt
    - path: /usr/bin/zypper
    - path: /bin/zypper
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - NIST
  - NIST_800-53_CM-7(4)
  - SI-4
  - process
  - NIST_800-53_SI-4

Description

Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection for attacks that bypass application level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries.

References

NIST-CM-7-5: [https://csf.tools/reference/nist-sp-800-53/r5/cm/cm-7/cm-7-5/]
mariadb-10-1-deny-remote-file-copy.yaml The adversary is trying to steal data. 5 Block MITRE MITRE_TA0008_lateral_movement MITRE_TA0010_exfiltration MITRE_TA0006_credential_access MITRE_T1552_unsecured_credentials NIST_800-53_SI-4(18) NIST NIST_800-53 NIST_800-53_SC-4

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-deny-remote-file-copy
  namespace: dvwa
spec:
  action: Block
  message: Alert! remote file copy tools execution prevented.
  process:
    matchPaths:
    - path: /usr/bin/rsync
    - path: /bin/rsync
    - path: /usr/bin/scp
    - path: /bin/scp
    - path: /usr/bin/scp
    - path: /bin/scp
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - MITRE
  - MITRE_TA0008_lateral_movement
  - MITRE_TA0010_exfiltration
  - MITRE_TA0006_credential_access
  - MITRE_T1552_unsecured_credentials
  - NIST_800-53_SI-4(18)
  - NIST
  - NIST_800-53
  - NIST_800-53_SC-4

Description

Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.

References

MITRE_TA0010_exfiltration: [https://attack.mitre.org/tactics/TA0010/]
mariadb-10-1-deny-write-in-shm-folder.yaml The adversary is trying to write under shm folder 5 Block MITRE_execution MITRE

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-deny-write-in-shm-folder
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /dev/shm/
      readOnly: true
      recursive: true
  message: Alert! write to /dev/shm folder prevented.
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - MITRE_execution
  - MITRE

Description

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data.

References

MITRE_execution: [https://attack.mitre.org/tactics/TA0002/]
mariadb-10-1-deny-write-under-etc-directory.yaml The adversary is trying to avoid being detected. 5 Block NIST_800-53_SI-7 NIST NIST_800-53_SI-4 NIST_800-53 MITRE_T1562.001_disable_or_modify_tools MITRE_T1036.005_match_legitimate_name_or_location MITRE_TA0003_persistence MITRE MITRE_T1036_masquerading MITRE_TA0005_defense_evasion

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-deny-write-under-etc-directory
  namespace: dvwa
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /etc/
      readOnly: true
      recursive: true
  message: Alert! File creation under /etc/ directory detected.
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - NIST_800-53_SI-7
  - NIST
  - NIST_800-53_SI-4
  - NIST_800-53
  - MITRE_T1562.001_disable_or_modify_tools
  - MITRE_T1036.005_match_legitimate_name_or_location
  - MITRE_TA0003_persistence
  - MITRE
  - MITRE_T1036_masquerading
  - MITRE_TA0005_defense_evasion

Description

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

References

MITRE_TA0005_defense_evasion: [https://attack.mitre.org/tactics/TA0005/]
mariadb-10-1-deny-write-under-etc-directory.yaml Adversaries may delete or modify artifacts generated within systems to remove evidence. 5 Block NIST NIST_800-53 NIST_800-53_CM-5 NIST_800-53_AU-6(8) MITRE_T1070_indicator_removal_on_host MITRE MITRE_T1036_masquerading

Kubearmor Security Policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: dvwa-mysql-mariadb-10-1-deny-write-under-etc-directory
  namespace: dvwa
spec:
  action: Block
  file:
    matchPaths:
    - fromSource:
      - path: /usr/bin/shred
      - path: /usr/bin/rm
      - path: /bin/mv
      - path: /bin/rm
      - path: /usr/bin/mv
      path: /root/*_history
    - fromSource:
      - path: /usr/bin/shred
      - path: /usr/bin/rm
      - path: /bin/rm
      - path: /bin/mv
      - path: /usr/bin/mv
      path: /home/*/*_history
  message: Alert! shell history modification or deletion detected and prevented
  selector:
    matchLabels:
      app: dvwa-mysql
      tier: backend
  severity: 5
  tags:
  - NIST
  - NIST_800-53
  - NIST_800-53_CM-5
  - NIST_800-53_AU-6(8)
  - MITRE_T1070_indicator_removal_on_host
  - MITRE
  - MITRE_T1036_masquerading

Description

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform. Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

References

MITRE_T1070_indicator_removal: [https://attack.mitre.org/techniques/T1070/]