mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-25 09:28:55 +00:00
rule update: fix missing entries
Signed-off-by: kaizhe <derek0405@gmail.com>
This commit is contained in:
parent
a43ae037a9
commit
e81decac13
@ -2421,6 +2421,11 @@
|
||||
condition: >
|
||||
((spawned_process and proc.name in (shred, rm, mv) and proc.args contains "bash_history") or
|
||||
(open_write and fd.name contains "bash_history" and evt.arg.flags contains "O_TRUNC"))
|
||||
output: >
|
||||
Shell history had been deleted or renamed (user=%user.name type=%evt.type command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath %container.info)
|
||||
priority:
|
||||
WARNING
|
||||
tag: [process, mitre_defense_evation]
|
||||
|
||||
- macro: consider_all_chmods
|
||||
condition: (always_true)
|
||||
|
Loading…
Reference in New Issue
Block a user