Skip to content

Security Events

Understanding Signatures in Tracee

In Tracee, a signature is a set of criteria designed to detect specific system activities based on events such as syscalls, network interactions, and LSM hook occurrences. When these foundational system events align with the conditions set by a signature, Tracee generates a corresponding "security event." This process enables Tracee to actively monitor and report potential security concerns arising from observed system interactions.

Functionality and Scope of Signatures

The signatures documented herein focus on key system operations. For instance, one signature identifies attempts to manipulate the syscall tables or the /proc filesystem, operations that are indicative of rootkit behaviors. Another detects the dynamic introduction of new executables into the system, flagging potential security issues. Upon a match, these signatures prompt Tracee to produce a security event, capturing the specifics of the underlying event and any associated implications.

The Role of Security Events in Tracee

Security events play a critical role in maintaining system integrity. They provide an analytical layer, translating raw events like syscalls into actionable insights about potential threats or anomalies. With the power of eBPF, Tracee efficiently monitors system activities in real-time, generating security events that equip users with the information they need to assess and respond to the state of their digital environments.

Be Prepared!

For optimal utilization of Tracee and effective response to potential threats, we strongly recommend readers to meticulously review each security event documentation page.

A good understanding of what each signature detects will empower users to make informed decisions and take appropriate actions when a security event arises. Being well-versed in the nuances of each signature ensures that you're not just alerted to risks, but also equipped to address them effectively.

List of Default Security Events

Name of Signature Description
Anti-Debugging Technique Detects anti-debugging techniques.
ASLR Inspection Detects ASLR inspections.
Cgroups notify_on_release File Modification Monitors notify_on_release file changes in cgroups.
Cgroups Release Agent File Modification Detects changes to the cgroup release_agent.
Core Dumps Config File Modification Monitors core dump configuration alterations.
Default Dynamic Loader Modification Tracks changes to the default binary loader.
Container Device Mount Detects unauthorized container device mounts.
Docker Socket Abuse Flags potential Docker socket misuse.
Dropped Executables Detects runtime-dropped executables.
Dynamic Code Loading Monitors dynamic code loading events.
Fileless Execution Flags fileless execution techniques.
Hidden Executable File Creation Detects creation of hidden executable files.
Illegitimate Shell Flags unauthorized or unexpected shell executions.
Kernel Module Loading Monitors kernel module load events.
Kubernetes API Server Connection Detects connections to the Kubernetes API server.
Kubernetes TLS Certificate Theft Flags potential theft of Kubernetes certificates.
LD_PRELOAD Code Injection Monitors LD_PRELOAD injection attempts.
File Operations Hooking on Proc Filesystem Detects hooks on file operations in /proc.
Kcore Memory File Read Monitors reads of /proc/kcore.
Process Memory Access Flags unauthorized /proc/mem access.
Procfs Mem Code Injection Detects code injections via /proc/mem.
Process VM Write Code Injection Monitors injections via process_vm_writev.
Ptrace Code Injection Detects ptrace-facilitated code injections.
RCD Modification Monitors changes to the remote control daemon.
Sched Debug Reconnaissance Flags /proc/sched_debug reconnaissance.
Scheduled Tasks Modification Tracks modifications to scheduled tasks.
Process Standard Input/Output over Socket Detects IO redirection over sockets.
Sudoers File Modification Monitors alterations to the sudoers file.
Syscall Table Hooking Detects syscall table hook attempts.
System Request Key Configuration Modification Monitors system request key configuration changes.