github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-25 12:19:56 +00:00
Code Issues Projects Releases Wiki Activity

Move wget and curl to own rule

Browse Source 
Signed-off-by: Erick Cheng <19863605+ec4n6@users.noreply.github.com>
This commit is contained in:
Erick Cheng
2021-11-10 09:44:56 +01:00
committed by poiana
parent bdba37a790
commit 205a8fd23b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@@ -2676,7 +2676,7 @@
tags: [file, mitre_persistence]
- list: remote_file_copy_binaries
items: [rsync, scp, sftp, dcp, wget, curl]
items: [rsync, scp, sftp, dcp]
- macro: remote_file_copy_procs
condition: (proc.name in (remote_file_copy_binaries))