poprhythm
ba925fe734
Detects unauthorized miners (and other runtime threats) via Falco's syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig compromise. Wired into netdata rather than a new notification channel: Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a new health.d alarm pages through netdata's already-configured Telegram bot - no new alerting infra needed. Includes a custom process-name rule for known miner binaries (the stock Stratum-protocol rule wouldn't have caught the actual gitea incident, which used a bare host:port with no scheme prefix), an outbound miner-pool-port rule as a second layer, and rule_matching: all in the Falco config - without it, Falco silently drops all but the first matching rule per event, which would have suppressed our custom rule whenever a stock rule also matched the same process.
14 lines
815 B
YAML
14 lines
815 B
YAML
# Tune out stock-rule false positives observed on this specific host, so the
|
|
# broad netdata "any Falco match" alarm only pages for things worth paging
|
|
# for. Uses Falco's own user_* customization macros rather than disabling
|
|
# whole rules, so the underlying security check stays active for everything
|
|
# else. Add entries here as new noisy defaults turn up - don't let this list
|
|
# grow into blinding Falco to anything actually meaningful.
|
|
|
|
# "Sensitive file opened for reading by non-trusted program" fired every
|
|
# ~10s from inbox-zero-db's pg_isready healthcheck touching /etc/shadow -
|
|
# NSS/libc user-lookup behavior during process init, not credential
|
|
# harvesting. Scoped to just this binary, not a blanket rule disable.
|
|
- macro: user_known_read_sensitive_files_activities
|
|
condition: (proc.name = pg_isready)
|