github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 16:17:32 +00:00
Code Issues Projects Releases Wiki Activity

Removed use cases not triggering

Browse Source 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
Co-authored-by: Brucedh <alessandro.brucato@sysdig.com>
Co-authored-by: AlbertoPellitteri <alberto.pellitteri@sysdig.com>
This commit is contained in:
Stefano 2022-04-12 22:53:58 +02:00 committed by poiana
parent 06b6565fa6
commit 65435d4418
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -3110,10 +3110,7 @@
- macro: curl_download - macro: curl_download
condition: proc.name = curl and condition: proc.name = curl and
(proc.cmdline contains " > " or (proc.cmdline contains " -o " or
proc.cmdline contains " >> " or
proc.cmdline contains " | " or
proc.cmdline contains " -o " or
proc.cmdline contains " --output " or proc.cmdline contains " --output " or
proc.cmdline contains " -O " or proc.cmdline contains " -O " or
proc.cmdline contains " --remote-name ") proc.cmdline contains " --remote-name ")