Falco informational stable other

Launch Suspicious Network Tool on Host

Detect network tools (like netcat, nmap, tcpdump, socat, and more) launched within containers without any additional filters. This serves as a valuable general detection, but it's recommended to invest engineering effort to fine-tune it and prevent a high volume of legitimate logs. The host equivalent of "Launch Suspicious Network Tool in Container.".

View Source

Detection Logic

spawned_process and not container and network_tool_procs and not user_known_network_tool_activities

Field Validations

Loading…

Comments (0)

Loading comments...