Falco informational stable other
Launch Suspicious Network Tool on Host
Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. The host equivalent of "Launch Suspicious Network Tool in Container.".
Detection Logic
spawned_process and not container and network_tool_procs and not user_known_network_tool_activities Field Validations
Loading…
Comments (0)
Loading comments...