github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity

rules: add OpenSSH private key to macro private_key_or_password

Browse Source 
Signed-off-by: Oscar Utbult <oscar.utbult@gmail.com>
This commit is contained in:
Oscar Utbult 2022-11-09 15:18:46 +01:00 committed by poiana
parent 1f15af1e4f
commit f43e6c445a
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rules/falco_rules.yaml
View File

@ -2548,6 +2548,7 @@
- macro: private_key_or_password - macro: private_key_or_password
condition: > condition: >
(proc.args icontains "BEGIN PRIVATE" or (proc.args icontains "BEGIN PRIVATE" or
proc.args icontains "BEGIN OPENSSH PRIVATE" or
proc.args icontains "BEGIN RSA PRIVATE" or proc.args icontains "BEGIN RSA PRIVATE" or
proc.args icontains "BEGIN DSA PRIVATE" or proc.args icontains "BEGIN DSA PRIVATE" or
proc.args icontains "BEGIN EC PRIVATE" or proc.args icontains "BEGIN EC PRIVATE" or