github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-10 13:13:40 +00:00
Code Issues Projects Releases Wiki Activity

Add an additional scripting-running-command combo

Browse Source 
Add an additional combination of scripting language like php/python/etc
+ a specific command line to parent_scripting_running_builds.
This commit is contained in:
Mark Stemm 2017-08-24 14:11:01 -07:00
parent 68cca84ba6
commit 151d1e67c5
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/falco_rules.yaml
View File

@ -340,16 +340,19 @@
- macro: parent_java_running_sbt - macro: parent_java_running_sbt
condition: (proc.pname=java and proc.pcmdline contains sbt-launch.jar) condition: (proc.pname=java and proc.pcmdline contains sbt-launch.jar)
# The crxlsx is a bit different than the other build-like things, but
# close enough to add here rather than create a separate macro.
- macro: parent_scripting_running_builds - macro: parent_scripting_running_builds
condition: > condition: >
(proc.pname in (php,php5-fpm,python,ruby,ruby2.3,node) and ( (proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,node) and (
proc.cmdline startswith "sh -c git" or proc.cmdline startswith "sh -c git" or
proc.cmdline startswith "sh -c date" or proc.cmdline startswith "sh -c date" or
proc.cmdline startswith "sh -c /usr/bin/g++" or proc.cmdline startswith "sh -c /usr/bin/g++" or
proc.cmdline startswith "sh -c /usr/bin/gcc" or proc.cmdline startswith "sh -c /usr/bin/gcc" or
proc.cmdline startswith "sh -c gcc" or proc.cmdline startswith "sh -c gcc" or
proc.cmdline startswith "sh -c if type gcc" or proc.cmdline startswith "sh -c if type gcc" or
proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git")) proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git" or
proc.cmdline startswith "sh -c /usr/src/app/crxlsx/bin/linux/crxlsx"))
- macro: parent_node_running_npm - macro: parent_node_running_npm
condition: proc.pcmdline startswith "node /usr/local/bin/npm" condition: proc.pcmdline startswith "node /usr/local/bin/npm"