falco: exclude loopback destinations from miner-pool-port rule

Confirmed 5 false positives over 2026-08-20 to 2026-08-25, all connecting
to ::1:8888 at ~21:3x daily - never a real mining-pool destination since
that's loopback, and every attempt failed instantly (nothing listens on
8888). Couldn't identify the source process (falco loses metadata for it
before it can be captured), but a real miner pool can never be localhost,
so excluding loopback fixes the false-positive class without weakening
the rule for actual remote pool connections.

falco/rules/miner-pool-ports.yaml

@@ -15,11 +15,20 @@
   # removed.
   items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]
 
+# Loopback exclusion added 2026-08-25: some unidentified host-level process
+# connects to ::1:8888 roughly once a day (confirmed 5x over 2026-08-20 to
+# 2026-08-25, always ~21:3x, always container=host, always failing instantly
+# since nothing listens on 8888 - falco loses process metadata for it before
+# it can be identified). A real mining pool is by definition a remote
+# server, so loopback destinations can never be genuine pool traffic - this
+# is a false positive in the rule's design (any port 8888 connection, not
+# just remote ones), not a tuned-out exception for a known process.
 - rule: Detect outbound connection to common miner pool port
   desc: Outbound connection to a TCP port commonly used by cryptomining pools.
   condition: >
     outbound and evt.type in (connect, sendto, sendmsg)
     and fd.rport in (miner_pool_ports)
+    and not (fd.rip in ("127.0.0.1", "::1"))
   output: >
     Outbound connection to common miner-pool port
     (user=%user.name command=%proc.cmdline connection=%fd.name