Falco high stable other
Detect outbound connections to common miner pool ports
Miners usually connect to miner pools using standard ports, and this rule flags such activity. Important: Falco currently sends DNS requests to resolve miner pool domains, which could trigger other alerts. Prior to enabling this rule, it's advised to ensure whether this is acceptable for your environment. This rule is specifically disabled for that reason.
Detection Logic
net_miner_pool and not trusted_images_query_miner_domain_dns Field Validations
Loading…
Comments (0)
Loading comments...