diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 1a0c2a3dd..15501fc25 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -321,7 +321,7 @@ # Network - macro: inbound condition: > - (((evt.type in (accept,listen) and evt.dir=<) or + (((evt.type in (accept,accept4,listen) and evt.dir=<) or (evt.type in (recvfrom,recvmsg) and evt.dir=< and fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and (fd.typechar = 4 or fd.typechar = 6) and @@ -345,7 +345,7 @@ # for efficiency. - macro: inbound_outbound condition: > - ((((evt.type in (accept,listen,connect) and evt.dir=<)) and + ((((evt.type in (accept,accept4,listen,connect) and evt.dir=<)) and (fd.typechar = 4 or fd.typechar = 6)) and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS))