From 27da50e3dffddf20f2d43f8c1c6681167c922839 Mon Sep 17 00:00:00 2001 From: kaizhe Date: Fri, 26 Jun 2020 15:52:49 -0700 Subject: [PATCH] rule(list network_tool_binaries): add zmap to the list Signed-off-by: kaizhe --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 55b4be28062..c7c552b4359 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2342,7 +2342,7 @@ tags: [network, k8s, container, mitre_port_knocking] - list: network_tool_binaries - items: [nc, ncat, nmap, dig, tcpdump, tshark, ngrep, telnet, mitmproxy, socat] + items: [nc, ncat, nmap, dig, tcpdump, tshark, ngrep, telnet, mitmproxy, socat, zmap] - macro: network_tool_procs condition: (proc.name in (network_tool_binaries))