Rule updates 2018 04.v2 #366
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
testing new falco integration |
mstemm
force-pushed
the
rule-updates-2018-04.v2
branch
2 times, most recently
from
0a08c22 to
f419af2
Compare
It can set symlinks below binary dirs.
Part of usermode package, can be used by oVirt.
Some package management programs run urlgrabber-ext-{down} to update pki
files.
for Jupyter-notebook
Used on centos
Also /etc/opt/VRTS...
Java, so we look at parent cmdline.
In an attempt to track down the source of some additional shell spawners, add additional parents.
Rename an existing macro chef_running_yum_dump to python_running_chef and add additional variants. Also add chef-client as a package management binary.
No longer in use.
Add pvscan as a volume management program and add an additional directory below /etc. Also rename the macro to make it more generic.
Only program is run-openldap.sh for now.
Also /etc/vom.
These are often seen in install scrips for rpm/deb packages. The test only checks for /etc/sed, as we don't have anything like a regex match or glob operator.
Only file is /root/tmp__.
Add run-mysqld and /etc/my.cnf.d directory.
Seen using port 111 (sun-rpc, but really user lookups).
Some users want to consider any shell spawned by tomcat suspect for example, protecting against the famous apache struts attack CVE-2017-5638, while others do not. Split the difference by adding a macro possibly_parent_java_running_tomcat, but disabling it by default.
mstemm
force-pushed
the
rule-updates-2018-04.v2
branch
from
4dcdd1e to
29923b3
Compare
Take the technique used by "Write below binary dir", and make it more general, expanding to a list of "monitored directories". This contains common directories like /boot, /lib, etc. It has a small workaround to look for home ssh directories without using the glob operator, which has a pending fix in draios/sysdig#1153.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.