Initial commit

infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml

@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: kubernetes-api-access-monitoring
+spec:
+  kprobes:
+    - call: tcp_connect
+      syscall: false
+      args:
+        - index: 0
+          type: sock
+      selectors:
+        - matchArgs:
+            - index: 0
+              operator: DPort
+              values:
+                - "6443"
+                - "443"
+          matchActions:
+            - action: Post

infrastructure/tetragon/tracing-policies/network-monitoring.yaml

@@ -0,0 +1,22 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: network-egress-monitoring
+spec:
+  kprobes:
+    - call: tcp_connect
+      syscall: false
+      args:
+        - index: 0
+          type: sock
+      selectors:
+        - matchActions:
+            - action: Post
+    - call: tcp_close
+      syscall: false
+      args:
+        - index: 0
+          type: sock
+      selectors:
+        - matchActions:
+            - action: Post

infrastructure/tetragon/tracing-policies/privilege-escalation.yaml

@@ -0,0 +1,32 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: privilege-escalation-detection
+spec:
+  kprobes:
+    - call: __x64_sys_setuid
+      syscall: true
+      args:
+        - index: 0
+          type: int
+      selectors:
+        - matchArgs:
+            - index: 0
+              operator: Equal
+              values:
+                - "0"
+          matchActions:
+            - action: Post
+    - call: __x64_sys_setgid
+      syscall: true
+      args:
+        - index: 0
+          type: int
+      selectors:
+        - matchArgs:
+            - index: 0
+              operator: Equal
+              values:
+                - "0"
+          matchActions:
+            - action: Post

infrastructure/tetragon/tracing-policies/process-execution.yaml

@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: shell-execution-monitoring
+spec:
+  tracepoints:
+    - subsystem: raw_syscalls
+      event: sys_enter
+      args:
+        - index: 4
+          type: syscall64
+      selectors:
+        - matchArgs:
+            - index: 4
+              operator: Equal
+              values:
+                - "59"  # execve
+          matchBinaries:
+            - operator: In
+              values:
+                - /bin/sh
+                - /bin/bash
+                - /bin/dash
+                - /usr/bin/bash
+                - /usr/bin/sh
+                - /usr/bin/curl
+                - /usr/bin/wget
+                - /usr/bin/nc
+                - /usr/bin/ncat
+          matchActions:
+            - action: Post

infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml

@@ -0,0 +1,26 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: sensitive-file-access
+spec:
+  kprobes:
+    - call: fd_install
+      syscall: false
+      args:
+        - index: 0
+          type: int
+        - index: 1
+          type: file
+      selectors:
+        - matchArgs:
+            - index: 1
+              operator: Prefix
+              values:
+                - /etc/shadow
+                - /etc/passwd
+                - /etc/gshadow
+                - /root/.ssh
+                - /etc/kubernetes/pki
+                - /var/run/secrets/kubernetes.io
+          matchActions:
+            - action: Post