Skip to content

Releases: falcosecurity/event-generator

v0.12.0

02 Oct 10:26
Compare
Choose a tag to compare

Changelog

  • f0a403c increase timeout for syscall.DisallowedSSHConnectionNonStandardPort
  • 3604216 update(events): disable PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  • 1958474 update(events): disable JavaProcessClassFileDownload
  • 490b030 use setup-go v3 gh action with go v1.23.1
  • fca56f5 rename files to be consistent with rules names
  • 89782de prevent zombie processes
  • 552829c move randomString() to a separate file, allowing build on macos
  • 93df6eb fix: Enhance Falco syscall events triggering and reliability
  • 7b0dab5 Added an event for default stable rule Detect release_agent File Container Escapes
  • 8356c82 Fix: Updated function name to the correct rule name
  • 3b014d2 Added an event for polkit local privilege escalation ulnerability
  • 298059d Added an event for default rule sudo potential privilege escalation
  • 7b41014 docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  • 883cdf3 Update events/syscall/mount_launched_in_privileged_container.go
  • be5fe89 adding event for this rule
  • c2adca2 adding an event on interpreted procs inbound network activity
  • ebc6f6c adding an event on modify container entrypoint
  • 9a20da3 adding an event on triggering rule
  • 7b0b5b9 adding an event on interpreted procs outbound network activity
  • 7a5a8b8 adding event on triggering this rule
  • f032e36 adding an event on packet_socket_created_in_container
  • 4309660 adding an event
  • dc15f1f Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  • d2d4264 adding an event for disallowed_ssh_connection_non_standard_port
  • c2b6f3c adding an event on reading environment variable from /proc files
  • 40ac2b5 Fix: Ptrace call is detached after a ptrace call with traceme argument from child process
  • d3adfc5 Added an event for default stable rule ptrace anti debug attempt
  • 5f70ab6 Added documentation for the skipping actions due non-supported context
  • 692bafe Refactor: use return.ErrSkipped to skip actions due to non supported context or prerequisite
  • 939b3e0 update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to copy the binary
  • b09fc0f Create a new binary by copying it form existing binary instead of creating a new binary
  • cba5af9 Added an event for default stable rule Drop and execute new binary in container
  • 7bc50fb more explained comment on why to use IP 169.254.169.254
  • a29607a adding comment on clarification of IP address
  • 630b95c updated comment
  • 4acde13 corrected an indentation error
  • ed1efff Update contact_cloud_metadata_service_from_container.go
  • 375da50 adding an event for contact cloud metadata service from container
  • e1c841c Fix: Event-generator executable is loaded into memory instead of go binary
  • 1102265 Event-generator executable path is now available to actions
  • d2ef0d6 Debris removed after functionreturn
  • a98f78b Added an event for fileless execution via memfd create
  • 17bacf7 Fix: Created a unique file under tmp dir
  • 6d91778 Added an event for default rule Container Drift Detected open+create
  • 8d53da5 Fix: Set execute permission on file via writefile instead of chmod
  • 9a3a784 Refactor command execution to use a dynamic script path and also added comments
  • 4489ba0 Create /dev/shm if not exists and Remove debris at end
  • 13276c2 Changing the condition to trigger falco rule
  • 8bc0b8d Code size reduced
  • d2a92d1 Created script file in dev shm folder if not exists
  • f1768f7 Added an event for default stable rule execution from dev shm
  • 4a1ca52 Update and rename launch_remote_file_copy_tool_in_container.go to launch_remote_file_copy_tools_in_container.go
  • 86b0004 Update launch_remote_file_copy_tool_in_container.go
  • fa8fd82 adding event on launch remote file copy tool in container
  • cda10d7 Fix: Create a unique temp file instead of using any random file name
  • 785aed5 Fix: Changed the function name according to name conventions in documentation
  • ab00990 Added an event for default rule set setuid or set setgid bit
  • 179be5f Refactor: Create a unique temp directory and changed function name
  • a973e7a created a directory and syslog file inside it
  • c04f57d Added an event for default stable rule clear log activities
  • def1cf1 Update unexpected_udp_traffic.go
  • e3ebb1f adding event on unexpected_udp_traffic
  • 20591ad chore: don't log inside DoNothing helper
  • 6b986b8 chore: fix copyright year
  • 8477547 update(events/helper): add the DoNothing helper
  • 2925790 Refactor: Just set execute permission on empty file is enough trigger the rule
  • a33421a Code size reduced
  • 27407a9 Added an event for default rule Container drift detected using chmod
  • 54e91ae Update netcat_remote_code_execution_in_container.go
  • 62cd476 adding event on netcat rce in container
  • 2250ff8 Fix: Updated comments for better understanding
  • 2a3d1bf Added an event for default stable rule PTRACE attached to process
  • 46d371f Update launch_suspicious_network_tool_in_container.go
  • e44be53 Rename launch_network_tool.go to launch_suspicious_network_tool_in_container.go
  • 16a1f14 Update launch_network_tool.go
  • a042219 Update launch_network_tool.go
  • dde0c94 adding an event of launching network tool
  • 786ea1c User uid is set to non zero when generating the event
  • 8a7d857 Added an event for default rule UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  • 2953f26 Switch to a new user such that username is not equal to _apt
  • f3b30db Added an event for Launch Package Management Process In Container
  • 9a0747d Update debugfs_launched_in_privilleged_container.go
  • 1d911a9 Update debugfs_launched_in_privilleged_container.go
  • ab58b70 event on debugfs launched in privilleged container
  • 5566085 Fix: Use MkdirTemp instead of Mkdir to create a unique temp directory
  • 44ce6f1 Now file is created by event generator and reads the shell configuration file
  • 53df01f Added an event for default rule read shell configuration file
  • d5a7eee Added an event for default stable rule find aws credentials
  • 34fb4c3 Fix: Rule triggers irrsepective of command successful or not
  • 7770275 Added an event for default rule Detect crypto miners using the Stratum protocol
  • d507f85 Fix: First look whether curl exists or not
  • 545c1f4 Refactor: Now http_proxy env variable set only for curl command not for entire event generator
  • 8e60661 HTTP_PROXY env variable value is reverted to its original value after function return
  • 4ef79f5 Added an event for default rule program run with diallowed http proxy env
  • 4c28e17 Fix: createSshDirectoryUnderHome also returns a cleanup function
  • 52df26e Fix: Helper function name changed
  • 0833a43 Refactored code by using a helper function CreateSshDirectoryUnderHome to remove code redundancy
  • adab5f3 Refactored ReadSshInformation function to improve directory creation logic
  • f569b18 Remove the created directory at end
  • 75dea5d Uncommented a line
  • 1ecb03f Reduced code size
  • 0ecd93a Using temporary data by creating them and removing them after completion
  • 3f5c815 Added an event for adding ssh keys to authorized keys
  • cb4f3c9 Refactor: createSshDirectoryUnderHome also returns a cleanup function
  • 47cb7b1 Fix: No need to export internal utilities
  • 71393e2 Fix: Event should be diabled by default as it is not a stable rule event
  • 72ac96a Fix: There is no need of for loop as MkdirTemp internally does it
  • fc57631 Added an helper function to create .ssh directory inside home
  • 9f9bb47 Refactored ReadSshInformation function to improve directory creation logic
  • 8599629 Remove the created directory at end
  • ceef898 Using temporary data by creating them and removing them after completion
  • 141a455 Added event for default rule read ssh information
  • 767157d Update modify_shell_configuration_file.go
  • 5e65be2 Update modify_shell_configuration_file.go
  • ddbadae Update modify_shell_configuration_file.go
  • 34c6228 Update modify_shell_configuration_file.go
  • 6bc3c4b adding an event for modifying shell configuration file
  • e048d5c Update events/syscall/delete_or_rename_shell_history.go
  • 9942d9f Update delete_or_rename_shell_history.go
  • 66b7a90 Update delete_or_rename_shell_history.go
  • 6f649c4 Update delete_or_rename_shell_history.go
  • 71b5d77 adding an event of deleting bash history
  • d96836b Fix: First look whether kubectl exists or not
  • 1a0b4ac Added an event for default rule kubernetes client tool launched in container
  • de7c8ef Fix: wget is just enough to trigger the rule
  • 3975d83 Added an event for default rule launch ingress remote file copy tools inside container
  • 2cc987e Update decoding_payload_in_container.go
  • 9c6f486 Update decoding_payload_in_container.go
  • 9067d37 adding event on triggering rule
  • 55cf1af Update and rename change_namespace_privillege_using_unshare.go to change_namespace_privileges_via_unshare.go
  • 06a5c5b Update events/syscall/change_namespace_privillege_using_unshare.go
  • 5e0be23 Update change_namespace_privillege_using_unshare.go
  • 825468b adding an event on change_namespace_privilleges_using_unshare
  • 2f37d9a Update events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  • 7592c8e Rename potential_local_privillege_escalation_via_env_var_misuse to potential_local_privillege_escalation_via_env_var_misuse.go
  • 6ba1c8e event on potential local privillefe escalation via env var misuse
  • efc5b17 Update events/syscall/launch_suspicious_network_tool_on_host.go
  • df80b6f Update launch_suspicious_network_tool_on_host.go
  • 77e19ca Rename launch_network_tool_on_host.go to launch_suspicious_network_tool_on_host.go
  • 098d0b3 adding event on launch network tool on host
  • 5a84d24 docs(events/README.md): update conventions
  • d691c7c Fixed some more broken links
  • d205623 Fix broken link by replacing it with valid url
  • cde96d9 fix(events/syscall/remove_bulk_data_from_disk): no new variables on left side of :=
  • 93c2ee7 No need to return error and updated comments
  • 4f36422 Updated comments
  • 0baee1e Added comments for explaination
  • 76c3685 Shred a file instead of directory
  • f76044e Update remove_bulk_data_from_disk.go
  • fb626a4 Clean up the temp directory
  • 3814b5a...
Read more

v0.11.1

31 Jan 10:58
Compare
Choose a tag to compare

What's Changed

  • fix(cmd): properly inherit --all flag. by @FedeDP in #91

Full Changelog: v0.11.0...v0.11.1

v0.11.0

30 Jan 14:55
Compare
Choose a tag to compare

What's Changed

  • docs(README.md): add scope and status badges by @leogr in #83
  • chore: bumped deps. by @FedeDP in #84
  • build: switch to Go 1.21 and tidy deps by @leogr in #85
  • docs: add license headers and spdx id by @leogr in #87
  • new(ci): use actuated.dev arm64 node. by @FedeDP in #88
  • docs(README.md): update grpc output socket name by @jgornowich in #89
  • Update for Falco 0.37 - event-generator 0.11 by @leogr in #90

New Contributors

Full Changelog: v0.10.2...v0.11.0

v0.10.2

09 May 09:29
Compare
Choose a tag to compare

Changelog

  • c70bca0 fix(Makefile): correct user-agent version
  • cbaac97 chore(readme): add an arch badge.

v0.10.1

19 Jan 13:13
Compare
Choose a tag to compare

What's Changed

Full Changelog: v0.10.0...v0.10.1

v0.10.0

21 Oct 13:29
Compare
Choose a tag to compare

Changelog

  • b86e3b5 docs(README.md): update repo URLs
  • 00413f2 docs(.github): correct CONTRIBUTING.md URL
  • 5897707 docs(events): correct URL to main branch
  • 913a5c0 update(circleci): use cimg/go instead of deprecated circleci/golang images.
  • 7a03cb5 fix: grpc unix path
  • d06aa05 update(OWNERS): move inactive approvers to emeritus_approvers
  • 63c06ea cleanup(k8s): remove k8s manifests files in favor of helm chart
  • de4c39b update(docs): update k8s section in README.md
  • b0f2f2c cleanup(ci): dropped gh actions.
  • f2455b9 new(ci): added github actions for non release jobs.
  • ca5ee01 new(ci): added arm64 ci.
  • 0395cd5 update(owners): add Federico Di Pierro as owner.

v0.9.0

06 Jun 12:21
Compare
Choose a tag to compare

Changelog

  • f156ba1 update(build): drop i386 support.
  • 55ad539 update(build): updated goreleaser adding the flag too.
  • 2501379 fix(build): force-set the pie build mode to allow arm64 images built on alpine to work.
  • 62f6f23 update(build): upgraded gopkg yaml dep version.
  • da3350f chore: restore old buildx install.
  • 2a2e4e7 update: since docker 20.10.x, cli experimental features are enabled by default.
  • 10b4dd8 update: since we are forcing docker version 20.x, buildx is already provided by it.

v0.8.1

27 Apr 08:49
Compare
Choose a tag to compare

Changelog

  • 3c88de4 fix: added missing line for latest images tag manifests.

v0.8.0

26 Apr 15:44
Compare
Choose a tag to compare

Changelog

  • b38ebf1 update: set a 60m timeout for both circleCI and goreleaser.
  • e2c72f3 Release docker images for arm64

v0.7.0

17 Mar 17:23
Compare
Choose a tag to compare

Changelog

  • 2b214a3 update(go.mod): bump client-go to version 0.5.0
  • 57e411f update(events/syscall): ChangeThreadNamespace disabled by default
  • ce756e1 feat(pkg/counter): added a DryRun option that avoids connecting to falco gRPC api.