Falco low stable other

Create Symlink Over Sensitive Files

Detect symlinks created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted".

View Source

Detection Logic

create_symlink and (evt.arg.target in (sensitive_file_names) or evt.arg.target in (sensitive_directory_names))

Field Validations

Loading…

Comments (0)

Loading comments...