Melissa Kilby

new(rules): Directory traversal monitored file read

16

Signed-off-by: Melissa Kilby **What type of PR is this?** /kind feature /kind rule-create **Any specific area of the project related to this PR?** /area rules **What this PR does /...

[Tracking] CI Integration for Driver Sanity Test Suites

6

Kicking off a discussion as result of https://github.com/falcosecurity/libs/pull/524 CI Integration / "Fun" for tool developer -> sanity for everyone :) Success Criteria: - Daily confirmation that driver state did not...

[WIP] new(test): add driver_sanity_test_suites

5

Signed-off-by: Melissa Kilby **What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug > /kind cleanup > /kind design /kind documentation > /kind...

(driver-bpf) possible race conditions in bpf_fget in rare network heavy workloads?

2

**Describe the bug** It seems like when the `socket` system call is enabled in the eBPF kernel driver, sometimes during an unlucky Falco run sockets are not closing in the...

[WIP] update(docs): add overview and versioning sections to falco release.md

3

Co-authored-by: Leonardo Grasso Signed-off-by: Melissa Kilby **What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug > /kind cleanup > /kind design /kind...

[WIP] update(rules): ehanced rules tagging for inventory / threat modeling

5

Signed-off-by: Melissa Kilby **What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug /kind cleanup > /kind design /kind documentation > /kind failing-test...

Documentation: Falco <-> libs versioning (more details)

2

Based on the discussion in https://github.com/falcosecurity/libs/pull/580 additional documentation in this repo (falco) can help increase technical clarity around versioning. - https://github.com/falcosecurity/libs/pull/580#discussion_r964497282 - https://github.com/falcosecurity/libs/pull/580#discussion_r964522134 CC @leogr

Add kernel signals exe_ino, exe_ino_ctime, exe_ino_mtime, pidns_init_start_ts + derived filter fields

11

**What type of PR is this?** > Uncomment one (or more) `/kind ` lines: > /kind bug /kind cleanup > /kind design > /kind documentation > /kind failing-test /kind feature...

[FEATURE] Options available for tapping into "linux_binprm" that holds args used when loading binaries

15

**Motivation** Quote from https://github.com/falcosecurity/libs/pull/595 > Another kernel side signal that would like to look into and possibly add to this PR would be: > > `"Interpreter scripts"` aka text files...

[TRACKING] "drop+exec" kernel signal correlations detections + threat modeling beyond

4

This issue is for tracking the development of a more generic and robust solution to detect the classic drop an implant and execute it TTP called "drop+exec". In addition, perform...