Skip to content

Commit

Permalink
rename rule
Browse files Browse the repository at this point in the history
Signed-off-by: kaizhe <derek0405@gmail.com>
  • Loading branch information
Kaizhe authored and poiana committed Apr 21, 2020
1 parent a1145d9 commit f7ac7f3
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2795,11 +2795,11 @@
priority: WARNING
tags: [network]

- rule: Reverse shell
desc: Detect reverse shell established remote connection in container.
- rule: Redirect stdout/stdin to network connection in container
desc: Detect redirecting stdout/stdin to network connection in container (potential reverse shell).
condition: evt.type=dup and evt.dir=> and container and fd.num in (0, 1, 2) and fd.type in ("ipv4", "ipv6")
output: >
Reverse shell connection (user=%user.name %container.info process=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository fd.name=%fd.name fd.num=%fd.num fd.type=%fd.type fd.sip=%fd.sip)
Redirect stdout/stdin to network connection (user=%user.name %container.info process=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository fd.name=%fd.name fd.num=%fd.num fd.type=%fd.type fd.sip=%fd.sip)
priority: WARNING

# Application rules have moved to application_rules.yaml. Please look
Expand Down

0 comments on commit f7ac7f3

Please sign in to comment.