Kh add process rules

[Kaizhe]

To test this PR:

1. Checkout the branch

2. Launch falco container with the updated falco rule yaml file

3. Run the following script:

#!/bin/bash

set -eux 

client=$(docker run -d --name client kaizheh/nginx-docker)

server=$(docker run -d --name server kaizheh/nginx-docker)

docker exec server bash -c "apt-get update && apt-get -y install nmap"

docker exec server bash -c "nc -lp 1234 -c 'cat /etc/passwd'" &

server_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $server)

docker exec client bash -c "nc $server_ip 1234"

To verify the output from falco container:

18:22:08.037417144: Error Package management process launched (user=root command=apt-get update container_id=7a222f00f4d0 container_name=server image=kaizheh/nginx-docker)
18:22:09.249714486: Error Package management process launched (user=root command=apt-get -y install nmap container_id=7a222f00f4d0 container_name=server image=kaizheh/nginx-docker)
18:22:19.057577326: Warning Netcat runs inside container that allows remote code execution (user=root command=nc -lp 1234 -c cat /etc/passwd container_id=7a222f00f4d0 container_name=server image=kaizheh/nginx-docker)
18:22:19.174572057: Notice Network tool launched (user=root command=nc 172.17.0.4 1234 container_id=1f2800fba7bc container_name=client image=kaizheh/nginx-docker)

[Kaizhe]

Rationale behind adding these rules:

1. package management tool can be used to download utils for malicious purpose (e.g. nmap). Given the micro service container scenario, package management should be done in the image build time for best practice.
2. Nmap can be used for reconnaissance purpose in customer's enviroment.
3. nc(netcat) and ncat can be either used for port scanning purpose or reverse shell.

[mstemm]

Thanks for the additions! They will be useful. Just some small typos/readability suggestions.