github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-23 16:38:52 +00:00
Code Issues Projects Releases Wiki Activity

Fix syntax error

Browse Source 
Signed-off-by: Erick Cheng <19863605+ec4n6@users.noreply.github.com>
This commit is contained in:
Erick Cheng 2021-11-18 16:47:08 +01:00 committed by poiana
parent 749d4b4512
commit 66df790b9d
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
rules/falco_rules.yaml
View File

@ -3096,13 +3096,13 @@
- macro: curl_download
condition: proc.name = curl and
(proc.cmdline contains (" > ") or
proc.cmdline contains (" >> ") or
proc.cmdline contains (" | ") or
proc.cmdline contains (" -o ") or
proc.cmdline contains (" --output ") or
proc.cmdline contains (" -O ") or
proc.cmdline contains (" --remote-name "))
(proc.cmdline contains " > " or
proc.cmdline contains " >> " or
proc.cmdline contains " | " or
proc.cmdline contains " -o " or
proc.cmdline contains " --output " or
proc.cmdline contains " -O " or
proc.cmdline contains " --remote-name ")
- rule: Launch Ingress Remote File Copy Tools in Container
desc: Detect ingress remote file copy tools launched in container