github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 15:17:50 +00:00
Code Issues Projects Releases Wiki Activity

rule update: fine grained sending to mining domain

Browse Source 
Signed-off-by: kaizhe <derek0405@gmail.com>
This commit is contained in:
kaizhe 2019-08-06 12:03:41 -07:00 committed by Lorenzo Fontana
parent a7ee01103d
commit 1fc509d78b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -2550,7 +2550,7 @@
condition: (fd.sport in (miner_ports) and fd.sip.name in (miner_domains)) condition: (fd.sport in (miner_ports) and fd.sip.name in (miner_domains))
- macro: net_miner_pool - macro: net_miner_pool
condition: (outbound and ((minerpool_http) or (minerpool_https) or (minerpool_other))) condition: (evt.type in (sendto, sendmsg) and evt.dir=< and ((minerpool_http) or (minerpool_https) or (minerpool_other)))
- rule: Detect outbound connections to common miner pool ports - rule: Detect outbound connections to common miner pool ports
desc: Miners typically connect to miner pools on common ports. desc: Miners typically connect to miner pools on common ports.