From d302060e4b68468fa644c6cb3deac2246dad63b1 Mon Sep 17 00:00:00 2001
From: poprhythm <james.kolpack@gmail.com>
Date: Tue, 25 Aug 2026 21:44:03 +0000
Subject: [PATCH] falco: exclude loopback destinations from miner-pool-port
 rule

Confirmed 5 false positives over 2026-08-20 to 2026-08-25, all connecting
to ::1:8888 at ~21:3x daily - never a real mining-pool destination since
that's loopback, and every attempt failed instantly (nothing listens on
8888). Couldn't identify the source process (falco loses metadata for it
before it can be captured), but a real miner pool can never be localhost,
so excluding loopback fixes the false-positive class without weakening
the rule for actual remote pool connections.
---
 falco/rules/miner-pool-ports.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/falco/rules/miner-pool-ports.yaml b/falco/rules/miner-pool-ports.yaml
index fb8fb9a..c91463a 100644
--- a/falco/rules/miner-pool-ports.yaml
+++ b/falco/rules/miner-pool-ports.yaml
@@ -15,11 +15,20 @@
   # removed.
   items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]
 
+# Loopback exclusion added 2026-08-25: some unidentified host-level process
+# connects to ::1:8888 roughly once a day (confirmed 5x over 2026-08-20 to
+# 2026-08-25, always ~21:3x, always container=host, always failing instantly
+# since nothing listens on 8888 - falco loses process metadata for it before
+# it can be identified). A real mining pool is by definition a remote
+# server, so loopback destinations can never be genuine pool traffic - this
+# is a false positive in the rule's design (any port 8888 connection, not
+# just remote ones), not a tuned-out exception for a known process.
 - rule: Detect outbound connection to common miner pool port
   desc: Outbound connection to a TCP port commonly used by cryptomining pools.
   condition: >
     outbound and evt.type in (connect, sendto, sendmsg)
     and fd.rport in (miner_pool_ports)
+    and not (fd.rip in ("127.0.0.1", "::1"))
   output: >
     Outbound connection to common miner-pool port
     (user=%user.name command=%proc.cmdline connection=%fd.name