Add typed host event egress rule
This commit is contained in:
parent
0b010df514
commit
3b037646d2
15 changed files with 360 additions and 31 deletions
14
tests/fixtures/sids/100067-interpreter-unusual-public-port.json
vendored
Normal file
14
tests/fixtures/sids/100067-interpreter-unusual-public-port.json
vendored
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"event": "tcp_connect",
|
||||
"pid": 4242,
|
||||
"ppid": 1,
|
||||
"uid": 1000,
|
||||
"comm": "python3",
|
||||
"parent_comm": "bash",
|
||||
"path": "/usr/bin/python3",
|
||||
"argv": ["-c", "connect back"],
|
||||
"peer_ip": "8.8.8.8",
|
||||
"peer_port": 4444,
|
||||
"local_ip": "10.0.0.5",
|
||||
"local_port": 51510
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue