Skip to content

Commit

Permalink
Merge branch 'rule-updates-2019-04.v4-MITRE-persistence' of https://g…
Browse files Browse the repository at this point in the history
…ithub.com/falcosecurity/falco into rule-updates-2019-04.v4-MITRE-persistence
  • Loading branch information
mstemm committed Apr 12, 2019
2 parents 6dcbd4a + 30a9814 commit 052e666
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1953,7 +1953,7 @@
desc: >
Detect grep private keys or passwords activity.
condition: >
(spawned_process and container and
(spawned_process and
((grep_commands and private_key_or_password) or
(proc.name = "find" and (proc.args contains "id_rsa" or proc.args contains "id_dsa")))
)
Expand Down

0 comments on commit 052e666

Please sign in to comment.