github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-20 09:27:47 +00:00
Code Issues Projects Releases Wiki Activity

Let node running yarn spawn shells.

Browse Source
This commit is contained in:
Mark Stemm
2017-10-05 08:54:35 -07:00
parent a68d2ad769
commit 33a28cc173
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
rules/falco_rules.yaml
View File

@@ -365,7 +365,8 @@
proc.cmdline startswith "sh -c gcc" or proc.cmdline startswith "sh -c gcc" or
proc.cmdline startswith "sh -c if type gcc" or proc.cmdline startswith "sh -c if type gcc" or
proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git" or proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git" or
proc.cmdline startswith "sh -c /usr/src/app/crxlsx/bin/linux/crxlsx")) proc.cmdline startswith "sh -c /usr/src/app/crxlsx/bin/linux/crxlsx" or
proc.pcmdline="node /opt/nodejs/bin/yarn"))
- macro: parent_node_running_npm - macro: parent_node_running_npm
condition: proc.pcmdline startswith "node /usr/local/bin/npm" condition: proc.pcmdline startswith "node /usr/local/bin/npm"