From 6dc350eb682d8d644e6342bd5ce44131106cc132 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lachance Date: Tue, 3 Dec 2019 12:06:55 -0500 Subject: [PATCH 1/2] Exclude exe_running_docker_save in the "Update Package Repository" rule Signed-off-by: Jean-Philippe Lachance --- rules/falco_rules.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index fd937c5df99..6319458dcaa 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -916,9 +916,11 @@ - rule: Update Package Repository desc: Detect package repositories get updated condition: > - ((open_write and access_repositories) or (modify and modify_repositories)) and not package_mgmt_procs + ((open_write and access_repositories) or (modify and modify_repositories)) + and not package_mgmt_procs + and not exe_running_docker_save output: > - Repository files get updated (user=%user.name command=%proc.cmdline file=%fd.name newpath=%evt.arg.newpath container_id=%container.id image=%container.image.repository) + Repository files get updated (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name newpath=%evt.arg.newpath container_id=%container.id image=%container.image.repository) priority: NOTICE tags: [filesystem, mitre_persistence] From ea96ffd15878314d2f9361b988fc31956677c2c5 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lachance Date: Tue, 3 Dec 2019 16:30:56 -0500 Subject: [PATCH 2/2] Apply Kaizhe's code review Signed-off-by: Jean-Philippe Lachance --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 6319458dcaa..b887aee5bd7 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -920,7 +920,7 @@ and not package_mgmt_procs and not exe_running_docker_save output: > - Repository files get updated (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name newpath=%evt.arg.newpath container_id=%container.id image=%container.image.repository) + Repository files get updated (user=%user.name command=%proc.cmdline pcmdline=%proc.pcmdline file=%fd.name newpath=%evt.arg.newpath container_id=%container.id image=%container.image.repository) priority: NOTICE tags: [filesystem, mitre_persistence]