Falco informational stable other

Launch Remote File Copy Tools in Container

Detect remote file copy tools (like rsync, scp, sftp, dcp) launched within a container, potentially indicating data exfiltration. Suggest refining this rule to accommodate legitimate use cases.

View Source

Detection Logic

spawned_process and container and remote_file_copy_procs and not user_known_remote_file_copy_activities

Field Validations

Loading…

Comments (0)

Loading comments...