poprhythm 9bf72f8e19 falco: add rules for git hook tampering and unexpected pack-service children ...

Written after the 2026-08-10/11 gitea internal-API log-poisoning attack
that planted a malicious uploadpack.packObjectsHook backdoor. Catches
both the planting (unexpected exec from a hooks/ path) and the firing
(git-upload-pack/git-receive-pack spawning anything but its own
pack-objects binary), independent of how the hook config got written.

2026-08-16 14:24:29 +00:00

..

config

falco: add cryptominer/runtime-security scanner wired into netdata

2026-08-08 17:41:20 +00:00

rules

falco: add rules for git hook tampering and unexpected pack-service children

2026-08-16 14:24:29 +00:00

docker-compose.yaml

falco: add rules for git hook tampering and unexpected pack-service children

2026-08-16 14:24:29 +00:00