This container will create detections and preventions only on Linux hosts, container platforms (e.g. OpenShift), and containers themselves, which are protected by a CrowdStrike sensor.

Automated detections currently available include:

Container images hosted at https://quay.io/repository/crowdstrike/detection-container are automatically rebuilt as mult-architecture images with every merged pull request. Pull this container with the following Docker (or podman!) command:

Using Docker CLI:

docker pull quay.io/crowdstrike/detection-container

Using Podman CLI:

podman pull quay.io/crowdstrike/detection-container

If a specific architecture is desired to be used, add the --platform flag with the desired architecture(s): linux/arm64,linux/amd64,linux/s390x,linux/ppc64le

Clone this repository and build the container using docker build or podman build:

With Docker CLI:

docker build -t <your_repository>/detection-container .

Podman CLI:

podman build -t <your_repository>/detection-container .

Multi-architecture Build (requires Docker with BuildKit):

make docker-buildx

The detection-container operates in one of two modes, suitable for both Docker and Kubernetes environments:

This mode exposes a text-based user interface (TUI) for selecting pre-canned scripts to generate simple detections (e.g., "hit #1 for credential dumping!").

An example of running in interactive mode is shown below:

For Docker, use the following command to run the detection container interactively:

sudo docker run --rm -it quay.io/crowdstrike/detection-container

For Kubernetes environments, refer to the vulnapp project for running the detection container interactively.

In this mode, detections are randomly generated with pauses between each to ensure uniqueness in the Falcon console. The pause duration ranges from 100 to 1800 seconds (approximately 1.5 to 30 minutes).

Output will be sent to the console (via stdout) regarding what detections are being generated. An example of running in non-interactive mode, plus output, is shown below:

For Docker, use the following command to run the detection container non-interactively:

sudo docker run --rm quay.io/crowdstrike/detection-container

For Kubernetes environments, use the following command to run the detection container non-interactively:

kubectl create -f https://raw.githubusercontent.com/CrowdStrike/detection-container/main/detections.example.yaml

For AWS ECS Fargate, use the following commands to run the detection container:

1. Create the CloudWatch log group if it doesn't already exist. Make sure to replace the region with your own:

   AWS_REGION="us-east-1"
   
   aws logs create-log-group \
     --log-group-name /ecs/detection-container \
     --region $AWS_REGION

2. Update and register the task definition:

   ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
   
   # Update task definition with your account ID and region
   sed -i "s/ACCOUNT_ID/$ACCOUNT_ID/g" ecs-task-definition.json
   sed -i "s/AWS_REGION/$AWS_REGION/g" ecs-task-definition.json
   
   # Register the task definition
   aws ecs register-task-definition \
     --cli-input-json file://ecs-task-definition.json

3. Run the task. Make sure to replace YOUR_CLUSTER, YOUR_SUBNET, and YOUR_SG with your own values:

   aws ecs run-task \
     --cluster YOUR_CLUSTER \
     --task-definition detection-container \
     --launch-type FARGATE \
     --network-configuration "awsvpcConfiguration={subnets=[YOUR_SUBNET],securityGroups=[YOUR_SG],assignPublicIp=ENABLED}"

4. View the logs in CloudWatch:

   # View logs in real-time (replace region if needed)
   aws logs tail /ecs/detection-container --follow --region us-east-1