minor fix

falcosecurity · Apr 11, 2019 · cb51e01 · cb51e01
1 parent 79d6943
commit cb51e01
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -1907,10 +1907,9 @@
 - rule: Create hidden files or directories
   desc: Detect hidden files or directories created
   condition: >
-    (container and
-     ((open_write and evt.arg.flags contains "O_CREAT" and 
+    (((open_write and evt.arg.flags contains "O_CREAT" and 
        fd.name contains "/." and not fd.name pmatch (exclude_hidden_directories)) or 
-      (mkdir and evt.arg.path contains "/.")))
+      (mkdir and evt.arg.path contains "/.")) and container)
   output: >
     Hidden file or directory created (user=%user.name command=%proc.cmdline 
     file=%fd.name container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)