Catalog

Alert on deployments with images that haven't been scanned in 30 days

Alert on deployments with images that haven't been updated in 90 days

Alert on deployments using an ADD command

Alert on deployments with the Alpine Linux package manager (apk) present

Alert when the Alpine Linux package manager (apk) is executed at runtime

Alert on deployments with images containing Apache Struts vulnerability CVE-2017-5638

Alert on deployments with containers escalating with CAP_SYS_ADMIN

Detected usage of the chkconfig service manager; typically this is not used within a container

Alert when binaries used to compile software are executed at runtime

Alert on deployments with containers with read-write root filesystem

Alerts if a deployment has containers with allowPrivilegeEscalation set to true in its security context.

Detects the usage of the crontab scheduled jobs editor

Cryptocurrency mining process spawned

Alert on deployments with curl present

Alerts if deployments are missing an ingress Network Policy

Deployments with externally exposed endpoints represent a higher risk

Containers should run as a non-root user

Images should be scanned frequently for any vulnerabilities. You should rebuild all images to include these patches and then instantiate new containers from them.

Ensure update instructions are not used alone in the Dockerfile

AppArmor is an effective and easy-to-use Linux application security system. It is available on some Linux distributions by default, for example, on Debian and Ubuntu.

The Process ID (PID) namespace isolates the process ID space, meaning that processes in different PID namespaces can have the same PID. This creates process level isolation between the containers and the host.

IPC (POSIX/SysV IPC) namespace provides separation of named shared memory segments, semaphores and message queues. The IPC namespace on the host should therefore not be shared with containers and should remain isolated.

Mount propagation mode allows mounting container volumes in Bidirectional, Host to Container, and None modes. Do not use Bidirectional mount propagation mode unless explicitly needed.

Seccomp filtering provides a means to filter incoming system calls. The default seccomp profile uses an allow list to permit a large number of common system calls, and block all others.

The TCP/IP port numbers below 1024 are considered privileged ports. Normal users and processes are not allowed to use them for various security reasons. Containers are, however, allowed to map their ports to privileged ports.

When HostNetwork is enabled the container is not placed inside a separate network stack. The container's networking is not containerized when this option is applied. The consequence of this is that the container has full access to the host's network interfaces. It also enables a shared UTS namespace. The UTS namespace provides isolation between two system identifiers: the hostname and the NIS domain name. It is used to set the hostname and the domain which are visible to running processes in that namespace. Processes running within containers do not typically require to know either the hostname or the domain name. The UTS namespace should therefore not be shared with the host.

Alert when a deployment does not drop all capabilities.

Alert on deployments that use the emergency annotation (e.g. "admission.stackrox.io/break-glass": "ticket-1234") to circumvent StackRox Admission Controller checks

Alert on deployments with environment variables that contain 'SECRET'

Alert on deployments running in privileged mode with fixable vulnerabilities with a CVSS of at least 6

Alert on deployments with fixable vulnerabilities with a CVSS of at least 7

Alert on deployments with fixable vulnerabilities with a Severity Rating at least Important

Alert on deployments with images that have not been scanned

Alert on deployments that use a Dockerfile with 'VOLUME /run/secrets'

Alert on deployments using 'insecure' in the command

Detects execution of iptables; iptables is a deprecated way of managing network state in containers

Alert on privileged pods that execute iptables or nftables

Alerts when Kubernetes API receives request to execute command in container

Alerts when Kubernetes API receives port forward request

Alert on the presence of the Kubernetes dashboard service

Alert on deployments with images using tag 'latest'

Detects when the 'addgroup' or 'groupadd' binary is executed, which can be used to add a new linux group.

Detects when the 'useradd', 'adduser' or 'usermod' binary is executed, which can be used to add a new linux user.

Alert on deployments with images containing the Log4Shell vulnerabilities (CVE-2021-44228 and CVE-2021-45046). There are flaws in the Java logging library Apache Log4j in versions from 2.0-beta9 to 2.15.0, excluding 2.12.2.

Processes that indicate login attempts

Alert on deployments with a volume mount on the container runtime socket

Alert on deployments mounting sensitive host directories

Detects execution of netcat in a container

Detects execution of binaries that can be used to manipulate network configuration and management.

Alerts when the nmap process launches in a container during run time

Alert on deployments that have containers without CPU request or memory limit

Alert when the Central secret is accessed.

Alert when the kubeadmin secret is accessed

Alert when user impersonation is used to access a secret within the cluster.

Processes that indicate attempts to change passwd

Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API.

Alert on deployments with containers running in privileged mode

Alert on containers running in privileged mode with important or critical fixable vulnerabilities

Detects misuse of the healthz/kubelet API/heapster endpoint

Detects misuse of the Kubernetes docker stats endpoint

Detects misuse of the Kubernetes Service API endpoint

Alert on deployments that contain processes running with UID 0

Alert on deployments with images containing components that are susceptible to a Denial of Service (DoS) vulnerability for HTTP/2 servers.

Alert when Red Hat images are not digitally signed by Red Hat

Alert when Red Hat/Fedora/CentOS package manager programs are executed at runtime.

Alert on deployments with components of the Red Hat/Fedora/CentOS package management system.

Alert on deployments that execute a remote file copy tool

Alert on deployments missing the 'email' annotation

Alert on deployments missing the 'owner' or 'team' annotation

Alert on deployments with images missing the specified label.

Alert on deployments missing the 'owner' or 'team' label

Alert on deployments with Kubernetes secret mounted as environment variable

Alert on deployments exposing port 22, commonly reserved for SSH access.

Alert on deployments exposing port 22, commonly reserved for SSH access.

Detects container running the SSH daemon

Processes that are known to use setuid binaries

Processes that indicate attempts to modify shadow files

Commands that are used to add/remove a shell

Detects execution of shell (bash/csh/sh/zsh) as a subprocess of a java application

Alert on deployments with images containing Spring4Shell vulnerability CVE-2022-22965 which affects the Spring MVC component and vulnerability CVE-2022-22963 which affects the Spring Cloud component. There are flaws in Spring Cloud Function (versions 3.1.6, 3.2.2 and older unsupported versions) and in Spring Framework (5.3.0 to 5.3.17, 5.2.0 to 5.2.19 and older unsupported versions).

Detected usage of the systemctl service manager

Detected usage of the systemd service manager

Alert when Debian/Ubuntu package manager programs are executed at runtime

Alert on deployments with components of the Debian/Ubuntu package management system in the image.

This policy generates a violation for the network flows that fall outside baselines for which 'alert on anomalous violations' is set.

This policy generates a violation for any process execution that is not explicitly allowed by a locked process baseline for a given container specification within a Kubernetes deployment.

Alert on deployments with wget present

All container images must carry a valid cosign signature.