rule(Create Hidden Files or Directories): Exclude exe_running_docker_…

…save Signed-off-by: James Barlow <james.barlow@finbourne.com>
falcosecurity · Jan 8, 2021 · 1acf106 · 1acf106
1 parent 7c234d1
commit 1acf106
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -2730,6 +2730,7 @@
      (open_write and evt.arg.flags contains "O_CREAT" and fd.name contains "/." and not fd.name pmatch (exclude_hidden_directories))) and
     consider_hidden_file_creation and
     not user_known_create_hidden_file_activities
+    and not exe_running_docker_save
   output: >
     Hidden file or directory created (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
     file=%fd.name newpath=%evt.arg.newpath container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)