github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-01 14:47:00 +00:00
Code Issues Projects Releases Wiki Activity

rules: add OpenSSH private key to macro private_key_or_password

Browse Source 
Signed-off-by: Oscar Utbult <oscar.utbult@gmail.com>
This commit is contained in:
Oscar Utbult
2022-11-09 15:18:46 +01:00
committed by poiana
parent 1f15af1e4f
commit f43e6c445a
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
rules/falco_rules.yaml
View File

@@ -2548,6 +2548,7 @@
- macro: private_key_or_password
condition: >
(proc.args icontains "BEGIN PRIVATE" or
proc.args icontains "BEGIN OPENSSH PRIVATE" or
proc.args icontains "BEGIN RSA PRIVATE" or
proc.args icontains "BEGIN DSA PRIVATE" or
proc.args icontains "BEGIN EC PRIVATE" or