github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-16 05:13:50 +00:00
Code Issues Projects Releases Wiki Activity

Add Java compatibility note

Browse Source 
Signed-off-by: joon <pirxthepilot@users.noreply.github.com>
This commit is contained in:
joon 2022-06-07 23:18:24 -07:00 committed by poiana
parent 583ac4192c
commit 625201f9f6
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rules/falco_rules.yaml
View File

@ -3179,6 +3179,7 @@
tags: [container, mitre_privilege_escalation, mitre_lateral_movement]
# Rule for detecting potential Log4Shell (CVE-2021-44228) exploitation
# Note: Not compatible with Java 17+, which uses read() syscalls
- macro: java_network_read
condition: (evt.type=recvfrom and fd.type in (ipv4, ipv6) and proc.name=java)