github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-26 14:52:20 +00:00
Code Issues Projects Releases Wiki Activity

Add wget and curl to remote_file_copy_binaries

Browse Source 
Signed-off-by: Erick Cheng <19863605+ec4n6@users.noreply.github.com>
This commit is contained in:
Erick Cheng 2021-11-02 16:21:32 +01:00 committed by poiana
parent 4c8e369691
commit d434853d5f
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -2676,7 +2676,7 @@
tags: [file, mitre_persistence] tags: [file, mitre_persistence]
- list: remote_file_copy_binaries - list: remote_file_copy_binaries
items: [rsync, scp, sftp, dcp] items: [rsync, scp, sftp, dcp, wget, scp]
- macro: remote_file_copy_procs - macro: remote_file_copy_procs
condition: (proc.name in (remote_file_copy_binaries)) condition: (proc.name in (remote_file_copy_binaries))