=== Reglas Falco PCI DSS (custom rules) ===
pci-dss-rules.yaml
# PCI DSS Custom Rules for Fintrixs Payment Platform
- rule: PCI - Shell Spawned in Container
  desc: Detect shell execution in any container (PCI 10.2.2)
  condition: >
    spawned_process and container and
    proc.name in (bash, sh, zsh, ash, dash, csh, ksh, fish) and
    not proc.pname in (containerd-shim, runc, node, npm, npx)
  output: "Shell spawned in container (user=%user.name command=%proc.cmdline container=%container.name image=%container.image.repository pod=%k8s.pod.name ns=%k8s.ns.name)"
  priority: WARNING
  tags: [pci_dss, req_10.2.2, container, shell]

- rule: PCI - Sensitive File Read
  desc: Detect reads to sensitive files (PCI 10.2.4)
  condition: >
    open_read and container and
    (fd.name startswith /etc/shadow or
     fd.name startswith /etc/passwd or
     fd.name startswith /etc/kubernetes or
     fd.name startswith /var/run/secrets)
  output: "Sensitive file read (user=%user.name file=%fd.name container=%container.name ns=%k8s.ns.name)"
  priority: WARNING
  tags: [pci_dss, req_10.2.4, filesystem]

- rule: PCI - Privilege Escalation Attempt
  desc: Detect setuid/setgid/sudo in containers (PCI 10.2.5)
  condition: >
    spawned_process and container and
    (proc.name in (sudo, su, setuid, chown, chmod) or
     proc.name = pkexec)
  output: "Privilege escalation attempt (user=%user.name command=%proc.cmdline container=%container.name ns=%k8s.ns.name)"
  priority: CRITICAL
  tags: [pci_dss, req_10.2.5, privilege_escalation]

- rule: PCI - Container Drift (New Binary)
  desc: Detect execution of binaries not present at container start (PCI 11.5)
  condition: >
    spawned_process and container and
    not proc.name in (node, npm, npx, sh, bash, tsc, jest, pg_isready, curl, wget) and
    proc.name pmatch (nc, ncat, nmap, masscan, tcpdump, wireshark, tshark)
  output: "Suspicious binary executed (user=%user.name command=%proc.cmdline container=%container.name ns=%k8s.ns.name)"
  priority: CRITICAL
  tags: [pci_dss, req_11.5, container_drift]

- rule: PCI - kubectl exec/attach
  desc: Detect kubectl exec or attach to containers (PCI 10.2.2)
  condition: >
    spawned_process and container and
    proc.pname = "runc" and proc.cmdline contains "exec"
  output: "kubectl exec/attach detected (user=%user.name command=%proc.cmdline pod=%k8s.pod.name ns=%k8s.ns.name)"
  priority: WARNING
  tags: [pci_dss, req_10.2.2, admin_access]

- rule: PCI - Crypto Mining Detection
  desc: Detect potential crypto mining activity (PCI 6.4.1)
  condition: >
    spawned_process and container and
    (proc.name in (xmrig, minerd, cpuminer, cgminer, bfgminer) or
     proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "pool.minexmr")
  output: "Crypto mining detected (user=%user.name command=%proc.cmdline container=%container.name ns=%k8s.ns.name)"
  priority: CRITICAL
  tags: [pci_dss, req_6.4.1, malware]

- rule: PCI - Unexpected Outbound from CDE
  desc: Detect outbound connections from CDE pods to unexpected destinations
  condition: >
    outbound and container and
    (k8s.pod.name contains "card-vault" or k8s.pod.name contains "tokenization") and
    not fd.sip.name in (cluster.local)
  output: "CDE pod outbound to unexpected destination (pod=%k8s.pod.name dest=%fd.sip:%fd.sport ns=%k8s.ns.name)"
  priority: WARNING
  tags: [pci_dss, req_1.3.4, cde, network]
=== Falco rules built-in (count + categorías) ===
25
reglas built-in

=== Falco rules tagging PCI / malware ===
  output: Read monitored file via directory traversal | file=%fd.name fileraw=%fd.nameraw gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  priority: WARNING
  tags: [maturity_stable, host, container, filesystem, mitre_credential_access, T1555]

- macro: cmp_cp_by_passwd
--
  output: Sensitive file opened for reading by trusted program after startup | file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  priority: WARNING
  tags: [maturity_stable, host, container, filesystem, mitre_credential_access, T1555]

- list: read_sensitive_file_binaries
--
  output: Sensitive file opened for reading by non-trusted program | file=%fd.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  priority: WARNING
  tags: [maturity_stable, host, container, filesystem, mitre_credential_access, T1555]

- macro: postgres_running_wal_e
--
  output: Shell spawned by untrusted binary | parent_exe=%proc.pexe parent_exepath=%proc.pexepath pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3] aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
  priority: NOTICE
  tags: [maturity_stable, host, container, process, shell, mitre_execution, T1059.004]

# These images are allowed both to run with --privileged and to mount
--
  output: System user ran an interactive command | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
  priority: INFO
  tags: [maturity_stable, host, container, users, mitre_execution, T1059, NIST_800-53_AC-2]

# In some cases, a shell is expected to be run in a container. For example, configuration
--
  output: A shell was spawned in a container with an attached terminal | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
  priority: NOTICE
  tags: [maturity_stable, container, shell, mitre_execution, T1059]

# For some container types (mesos), there isn't a container image to
--
  output: Unexpected connection to K8s API Server from container | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  priority: NOTICE
  tags: [maturity_stable, container, network, k8s, mitre_discovery, T1565]

