mirror of
https://github.com/vee1e/KubeArmor.git
synced 2026-09-01 10:18:29 +00:00
42 lines
876 B
YAML
42 lines
876 B
YAML
apiVersion: security.kubearmor.com/v1
|
|
kind: KubeArmorClusterPolicy
|
|
metadata:
|
|
annotations:
|
|
app.kubearmor.io/source: KubeArmor Operator
|
|
app.kubearmor.io/type: harden
|
|
name: harden-crypto-miners
|
|
spec:
|
|
action: Block
|
|
file:
|
|
matchDirectories:
|
|
- dir: /bin/
|
|
readOnly: true
|
|
recursive: true
|
|
- dir: /boot/
|
|
readOnly: true
|
|
recursive: true
|
|
- dir: /sbin/
|
|
readOnly: true
|
|
recursive: true
|
|
- dir: /usr/bin/
|
|
readOnly: true
|
|
recursive: true
|
|
- dir: /usr/local/bin/
|
|
readOnly: true
|
|
recursive: true
|
|
- dir: /var/local/bin/
|
|
readOnly: true
|
|
recursive: true
|
|
message: cryptominer detected and blocked
|
|
process:
|
|
matchDirectories:
|
|
- dir: /tmp/
|
|
recursive: true
|
|
selector:
|
|
matchExpressions:
|
|
severity: 10
|
|
tags:
|
|
- MITRE
|
|
- MITRE_T1496_resource_hijacking
|
|
- cryptominer
|
|
|