github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-15 23:36:19 +00:00
Code Issues Projects Releases Wiki Activity

Let adclient/certutil spawn shells/write below etc

Browse Source 
Let adclient/certutil spawn shells and write below etc.
This commit is contained in:
Mark Stemm 2017-09-25 07:51:18 -07:00
parent 96992d7ac3
commit d9cb1e2b27
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rules/falco_rules.yaml
View File

@ -448,7 +448,8 @@
systemd, systemd-machine, systemd-sysuser,
debconf-show, rollerd, bind9.postinst, sv,
gen_resolvconf., update-ca-certi, certbot, runsv,
qualys-cloud-ag, locales.postins, nomachine_binaries)
qualys-cloud-ag, locales.postins, nomachine_binaries,
adclient, certutil)
and not proc.pname in (sysdigcloud_binaries, sendmail_config_binaries, hddtemp.postins)
and not fd.name pmatch (safe_etc_dirs)
and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc)
@ -613,7 +614,7 @@
landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini,
timeout, updatedb.findut, mysql_ssl_rsa_s
timeout, updatedb.findut, mysql_ssl_rsa_s, adclient
]
- rule: Run shell untrusted