mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
17 lines
659 B
Plaintext
17 lines
659 B
Plaintext
# A very simple config for introductory purpose. Not for the real-world!
|
|
|
|
# Binary directories
|
|
bin_dir: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)
|
|
|
|
# Core binaries
|
|
core_binaries: proc.name in (ls, mkdir, cat, less, ps)
|
|
|
|
# Network traffic to/from standard utility
|
|
(fd.typechar = 4 or fd.typechar=6) and core_binaries | %evt.time: %proc.name network with %fd.l4proto
|
|
|
|
# System binary is modified
|
|
evt.type = write and bin_dir | %evt.time: System binary modified (file '%fd.filename' written by process %proc.name)
|
|
|
|
# Shell running in container
|
|
container.id != host and proc.name = bash | %evt.time: Shell running in container (%proc.name, %container.id)
|