From 2f4b39ae6f01726636ee512a8d6b4d36df87b5cc Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Thu, 9 Nov 2017 14:12:41 -0800 Subject: [PATCH] Let find spawn shells --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 5c4865c8..71b94354 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -871,7 +871,7 @@ nginx_control, mailmng-service, web_statistic_e, statistics_coll, install-info, hawkular-metric, rhsmcertd-worke, parted, amuled, fluentd, x2gormforward, parallels_insta, salt-minion, dnsmng, update-inetd, pum_worker, awstats_buildst, - tsvuln, 50plesk-daily, grubby, chkconfig, dracut-install, rhnsd + tsvuln, 50plesk-daily, grubby, chkconfig, dracut-install, rhnsd, find ] - rule: Run shell untrusted