Skip to content

Commit

Permalink
Rule Update - Adds npm support
Browse files Browse the repository at this point in the history
Adds `npm` to `package_mgmt_binaries` for detection of "living off the land" style attacks that utilize NPM pull down additional tooling
  • Loading branch information
rileydakota committed Jan 24, 2022
1 parent 2f82a9b commit 76c1aff
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@
# The truncated dpkg-preconfigu is intentional, process names are
# truncated at the falcosecurity-libs level.
- list: package_mgmt_binaries
items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd]
items: [rpm_binaries, deb_binaries, update-alternat, gem, npm, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd]

- macro: package_mgmt_procs
condition: proc.name in (package_mgmt_binaries)
Expand Down

0 comments on commit 76c1aff

Please sign in to comment.