Aldo Lacuku 07b4d5a47a fix(rules): use exit event in reverse shell detection rule ...

In some cases the rule is not triggered when a reverse shell is spawned.
That's because in the rule we are checking that the file descriptor passed
as argument to the dup functions is of type socket and its fd number is "0, 1, or 2"
and the event direction is "enter".
The following event does not trigger the rule: dup2(socket_fd, STDIN_FILENO);
But using the exit event the rule is triggered.

Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>

2022-06-23 10:06:13 +02:00

..

application_rules.yaml

…

CMakeLists.txt

update!: moving out plugins ruleset files

2022-05-12 18:28:34 +02:00

falco_rules.local.yaml

…

falco_rules.yaml

fix(rules): use exit event in reverse shell detection rule

2022-06-23 10:06:13 +02:00

OWNERS

remove kaizhe from falco rule owner

2022-06-22 22:16:21 -05:00