# Security-Concept Published articles for Security-Concept. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Blog: Preventing attacker persistence with Falco on AWS DevFeed: [Blog: Preventing attacker persistence with Falco on AWS]() Original publisher: [Read original article]() Published: 2024-03-11T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Amazon Web Services](), [AWS CloudTrail](), [AWS Lambda](), [Persistence](), [Code]() Tags: [aws](), [aws-cloudtrail](), [aws-lambda](), [falco](), [incident-response](), [ip](), [lambda](), [mfa](), [persistence](), [request](), [s3](), [security-concept]() ### AI overview This article explains how an attacker could modify an existing Lex-based AWS Lambda function to disclose AWS credentials when triggered by a secret phrase. It describes using Falco's AWS CloudTrail plugin and rules to detect Lambda code updates and alert engineers for investigation. ### Source excerpt I recently read an interesting blog on how hackers could use a Lambda function alongside Lex to establish persistence in an AWS account. For those unfamiliar with the term, persistence is when attackers leverage some technique to retain access to systems without being detected. A recent news article cited a study that reported that some Chinese hackers have lurked in systems for up to FIVE YEARS! Luckily for all of us, Falco can be used to detect the exact scenario detailed in the blog and immediately raise an alert. The blog detailed how an attacker who has gained access to an AWS account could modify an existing Lex-based Lambda function to provide a set of AWS credentials. In short, the attacker modified the function of the Lex-based chatbot to respond whenever a secret phrase was entered with the Lambda's AWS key ID and secret key. The author notes there are several ways to establish persistence on AWS, and maybe this wasn't the most practical, but I still found it a fun exercise. It got me thinking: How could Falco help here? My immediate thought was to use Falco's AWS Cloudtrail plugin. The plugin, as the name implies, ingests Cloudtrail events. The events can be evaluated against a set of rules to alert engineers of any suspicious activity. There are currently just over 20 different rules that can be assessed. They include scenarios like creating new users, having someone log into the root account without MFA, changing permissions on an S3 bucket, and, most relevant to our discussion here, modifying a Lambda function. - rule: Update Lambda Function Code desc: Detect updates to a Lambda function code. condition: ct.name="UpdateFunctionCode20150331v2" and not ct.error exists output: The code of a Lambda function has been updated. (requesting user=%ct.user, requesting IP=%ct.srcip, AWS region=%ct.region, lambda function=%ct.request.functionname) priority: WARNING tags: - cloud - MITRE_TA0003_persistence - aws_lambda source: aws_cloudtrail Alternatively, you coul ## Blog: Automate Kubernetes Network Security with Falco Talon DevFeed: [Blog: Automate Kubernetes Network Security with Falco Talon]() Original publisher: [Read original article]() Published: 2024-02-09T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Falco](), [network security](), [threat detection](), [C2]() Tags: [c2](), [falco](), [kubernetes](), [network-security](), [security](), [security-concept](), [threat-detection]() ### AI overview This article explains how Falco Talon can automate Kubernetes network security by responding to detected threats and updating network policies. It describes the limitations of IP-based policies and proposes using labels to isolate suspicious network traffic at runtime. ### Source excerpt Falco Talon Repository: https://github.com/Falco-Talon/falco-talon Falco Talon Documentation: https://falco-talon.github.io/ Falco Talon is currently under active development and remains in the alpha stage; therefore, breaking changes may occur at any time, and the documentation may not always be up to date. Setting up robust network security in Kubernetes is a challenge that demands both precision and adaptability. NetworkPolicy offers the potential for highly specific network configurations, enabling or blocking traffic based on a comprehensive set of criteria. However, the dynamic nature of network topologies and the complexities of managing policy implementations present ongoing challenges. The need for constant policy updates, especially in response to changing threat landscapes, introduces risks such as the potential for misconfiguration and the unintended dropping of packets. The Challenge of IP-Based Network Policies Building network policies around IP addresses is notoriously challenging. For instance, threat feeds, which list known malicious IP addresses, are constantly changing. An IP address associated with a malicious entity one week might be reassigned and deemed safe the next. This fluidity necessitates an agile approach to network policy management, integrating solutions like NetworkSets to dynamically update policies based on the latest intelligence. However, the sheer volume of threat intelligence feeds - from Tor IP lists to cryptomining blocklists - complicates this integration, making it a daunting task to maintain accurate network controls. Here, Falco Talon emerges as a transformative solution. By leveraging Falco's detection capabilities, such as identifying Outbound Connections to C2 Servers, Falco Talon can instantly update Kubernetes network policies to block all egress traffic except allowed CIDR ranges. This is facilitated through the kubernetes:networkpolicy Talon action, demonstrating a seamless integration of dynamic threat detection ## Blog: Install and Test Atomic Red in Kubernetes DevFeed: [Blog: Install and Test Atomic Red in Kubernetes]() Original publisher: [Read original article]() Published: 2023-12-12T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Falco](), [threat detection](), [Testing](), [Security](), [Open Source]() Tags: [deployment](), [falco](), [installation](), [kubernetes](), [mapping](), [open-source](), [security](), [security-concept](), [staging](), [test-lab](), [testing](), [threat-detection]() ### AI overview This tutorial explains how to deploy and test Atomic Red Team in Kubernetes and use the open source Falco to detect simulated threats in real time. It describes evaluating detections against the MITRE ATT&CK framework, identifying coverage gaps, and refining custom rules. The article recommends using a test lab or staging environment rather than production. ### Source excerpt In cloud-native environments, where applications scale up and down much faster than traditional monolithic application architectures, the ability to proactively identify and respond to threats in real time is paramount. As more organizations embrace cloud-native architectures for application delivery, more robust security measures need to be introduced. In this blog post, we delve into the dynamic realm of Kubernetes threat detection by exploring how open source Falco can seamlessly detect Atomic Red Team tests in real time within Kubernetes environments. Atomic Red Team is a powerful framework designed to simulate real-world attacks, providing organizations with a controlled environment to validate the effectiveness of their security measures. We take this a step further by deploying Atomic Red to Kubernetes with a single command, creating a realistic testing ground for evaluating the responsiveness of Falco. Our journey begins with the effortless deployment of Atomic Red to Kubernetes, showcasing the simplicity and efficiency of orchestrating security testing within containerized environments. Once deployed, we invoke specific Atomic Red Team tests, simulating a range of threat scenarios. The true test lies in Falco's ability to detect these threats in line with the MITRE ATT&CK framework, a globally-recognized matrix mapping adversary techniques to defensive tactics. This exploration is not just about identifying threats; it's a collaborative effort to enhance Falco's coverage. Should we identify any gaps in detection, we dive deeper, revising the executed techniques and crafting custom rules. This iterative process aims to extend our MITRE ATT&CK coverage, aligning Falco with the industry's best practices for threat detection and mitigation. Deploying Atomic Red Team To avoid any potential service disruption in production environments, we recommend installing Atomic Red in a test lab environment, or at least a staging environment of Kubernetes. We have a step-by