Falco informational stable other

Launch Ingress Remote File Copy Tools in Container

Detect ingress remote file copy tools (such as curl or wget) launched inside containers. This rule can be considered a valuable auditing tool, but it has the potential to generate notable noise and requires careful profiling before full operationalization.

View Source

Detection Logic

spawned_process and container and (ingress_remote_file_copy_procs or curl_download) and not user_known_ingress_remote_file_copy_activities

Field Validations

Loading…

Comments (0)

Loading comments...