github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-18 07:51:12 +00:00
Code Issues Projects Releases Wiki Activity

Add wget and curl to remote_file_copy_binaries

Browse Source 
Signed-off-by: Erick Cheng <19863605+ec4n6@users.noreply.github.com>
This commit is contained in:
Erick Cheng
2021-11-02 16:21:32 +01:00
committed by poiana
parent b0565794f5
commit 19fb3458ef
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@@ -2676,7 +2676,7 @@
tags: [file, mitre_persistence]
- list: remote_file_copy_binaries
items: [rsync, scp, sftp, dcp]
items: [rsync, scp, sftp, dcp, wget, scp]
- macro: remote_file_copy_procs
condition: (proc.name in (remote_file_copy_binaries))