falco: add rules for git hook tampering and unexpected pack-service children

Written after the 2026-08-10/11 gitea internal-API log-poisoning attack that planted a malicious uploadpack.packObjectsHook backdoor. Catches both the planting (unexpected exec from a hooks/ path) and the firing (git-upload-pack/git-receive-pack spawning anything but its own pack-objects binary), independent of how the hook config got written.
2026-08-16 14:24:29 +00:00
parent 6a52b6195a
commit 9bf72f8e19
3 changed files with 59 additions and 0 deletions
@@ -32,3 +32,5 @@ services:
      - ./rules/miner-detect.yaml:/etc/falco/rules.d/miner-detect.yaml:ro
      - ./rules/miner-pool-ports.yaml:/etc/falco/rules.d/miner-pool-ports.yaml:ro
      - ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
+      - ./rules/git-hook-tamper.yaml:/etc/falco/rules.d/git-hook-tamper.yaml:ro
+      - ./rules/unexpected-child-of-git.yaml:/etc/falco/rules.d/unexpected-child-of-git.yaml:ro