github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 15:17:50 +00:00
Code Issues Projects Releases Wiki Activity

Fix remove scp and add curl

Browse Source 
Signed-off-by: Erick Cheng <19863605+ec4n6@users.noreply.github.com>
This commit is contained in:
Erick Cheng 2021-11-02 16:34:42 +01:00 committed by poiana
parent d434853d5f
commit c4d25b1d24
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -2676,7 +2676,7 @@
tags: [file, mitre_persistence] tags: [file, mitre_persistence]
- list: remote_file_copy_binaries - list: remote_file_copy_binaries
items: [rsync, scp, sftp, dcp, wget, scp] items: [rsync, scp, sftp, dcp, wget, curl]
- macro: remote_file_copy_procs - macro: remote_file_copy_procs
condition: (proc.name in (remote_file_copy_binaries)) condition: (proc.name in (remote_file_copy_binaries))