update(falco-incubating_rules.yaml): add Backdoored library loaded in…

[loresuso]

…to SSHD rule

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

Proposed rule maturity level

Uncomment one (or more) /area <> lines (only for PRs that add or modify rules):

/area maturity-stable

/area maturity-incubating

/area maturity-sandbox

/area maturity-deprecated

What this PR does / why we need it:

Detect the sshd process loading a vulnerable version of libzlma

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

[github-actions]

Rules files suggestions

falco-incubating_rules.yaml

Comparing 18782857a86acd3a4c4501bbe316beb52d240d6c with latest tag falco-incubating-rules-3.0.1

Minor changes:

• Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been added

Patch changes:

• List falco_privileged_images has some item added or removed

[github-actions]

Rules files suggestions

falco-incubating_rules.yaml

Comparing cbe2125a0edc1ea23a0ba04ba8daf7a0cc46e90f with latest tag falco-incubating-rules-3.0.1

Minor changes:

• Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been added

Patch changes:

• List falco_privileged_images has some item added or removed

[github-actions]

Rules files suggestions

falco-incubating_rules.yaml

Comparing 8cf87fecb2177d742b90b3509a0d784ac70eac5e with latest tag falco-incubating-rules-3.0.1

Minor changes:

• Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been added

Patch changes:

• List falco_privileged_images has some item added or removed

[github-actions]

Rules files suggestions

falco-incubating_rules.yaml

Comparing 277d30982fea6d5f700daffd47f500b841c4762b with latest tag falco-incubating-rules-3.0.1

Minor changes:

• Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been added

Patch changes:

• List falco_privileged_images has some item added or removed

[github-actions]

Rules files suggestions

falco-incubating_rules.yaml

Comparing 479be42745cc1b50f72d6a716fb7e4967364a25e with latest tag falco-incubating-rules-3.0.1

Minor changes:

• Rule Backdoored library loaded into SSHD (CVE-2024-3094) has been added

Patch changes:

• List falco_privileged_images has some item added or removed

[LucaGuerra]

Thank you!

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: loresuso, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [LucaGuerra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[poiana]

LGTM label has been added.

Git tree hash: a5f03a0d5aba54d53f4b64fe5dc802d5796d1157