kubescape · sarieren · Sep 11, 2024 · Oct 2, 2024 · Oct 2, 2024 · Oct 8, 2024
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
diff --git a/.github/workflows/component-tests.yaml b/.github/workflows/component-tests.yaml
diff --git a/.github/workflows/pr-created.yaml b/.github/workflows/pr-created.yaml
diff --git a/.github/workflows/pr-merged.yaml b/.github/workflows/pr-merged.yaml
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
diff --git a/.gitignore b/.gitignore
diff --git a/LICENSE b/LICENSE
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
diff --git a/Makefile b/Makefile
diff --git a/README.md b/README.md
diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
diff --git a/SECURITY.md b/SECURITY.md
diff --git a/alertbindings.yaml b/alertbindings.yaml
@@ -0,0 +1,67 @@
+apiVersion: kubescape.io/v1
+kind: RuntimeRuleAlertBinding
+metadata:
+  annotations:
+    meta.helm.sh/release-name: kubescape
+    meta.helm.sh/release-namespace: kubescape
+  creationTimestamp: "2024-11-26T11:07:08Z"
+  generation: 1
+  labels:
+    app: node-agent
+    app.kubernetes.io/component: node-agent
+    app.kubernetes.io/instance: kubescape
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kubescape-operator
+    app.kubernetes.io/version: 1.23.2
+    helm.sh/chart: kubescape-operator-1.23.2
+    kubescape.io/ignore: "true"
+    tier: ks-control-plane
+  name: all-rules-all-pods
+  resourceVersion: "516"
+  uid: 78bc578c-6374-4641-adc3-a5f067d5a748
+spec:
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: NotIn
+      values:
+      - kubescape
+      - kube-system
+      - kube-public
+      - kube-node-lease
+      - kubeconfig
+      - gmp-system
+      - gmp-public
+  rules:
+  - ruleName: Unexpected process launched
+  - parameters:
+      ignoreMounts: true
+      ignorePrefixes:
+      - /proc
+      - /run/secrets/kubernetes.io/serviceaccount
+      - /var/run/secrets/kubernetes.io/serviceaccount
+      - /tmp
+    ruleName: Unexpected file access
+  - ruleName: Unexpected system call
+  - ruleName: Unexpected capability used
+  - ruleName: Unexpected domain request
+  - ruleName: Unexpected Service Account Token Access
+  - ruleName: Kubernetes Client Executed
+  - ruleName: Exec from malicious source
+  - ruleName: Kernel Module Load
+  - ruleName: Exec Binary Not In Base Image
+  - ruleName: Malicious SSH Connection
+  - ruleName: Fileless Execution
+  - ruleName: Exec from mount
+  - ruleName: Crypto Mining Related Port Communication
+  - ruleName: Crypto Mining Domain Communication
+  - ruleName: Read Environment Variables from procfs
+  - ruleName: eBPF Program Load
+  - ruleName: Symlink Created Over Sensitive File
+  - ruleName: Unexpected Sensitive File Access
+  - ruleName: Hardlink Created Over Sensitive File
+  - ruleName: Exec to pod
+  - ruleName: Port forward
+  - ruleName: Unexpected Egress Network Traffic
+  - ruleName: Malicious Ptrace Usage
+  - ruleName: Crypto Miner detected
diff --git a/build/Dockerfile b/build/Dockerfile
diff --git a/build/README.md b/build/README.md
diff --git a/clamav/Dockerfile b/clamav/Dockerfile
diff --git a/clamav/Makefile b/clamav/Makefile
diff --git a/clamav/README.md b/clamav/README.md
diff --git a/configuration/clusterData.json b/configuration/clusterData.json
diff --git a/configuration/config.json b/configuration/config.json
diff --git a/demo/README.md b/demo/README.md
diff --git a/demo/assets/alertmanager.png b/demo/assets/alertmanager.png
diff --git a/demo/assets/fileless-malware.png b/demo/assets/fileless-malware.png
diff --git a/demo/assets/kubectl.png b/demo/assets/kubectl.png
diff --git a/demo/assets/ls.png b/demo/assets/ls.png
diff --git a/demo/assets/malwares.png b/demo/assets/malwares.png
diff --git a/demo/assets/ping.png b/demo/assets/ping.png
diff --git a/demo/assets/pods.png b/demo/assets/pods.png
diff --git a/demo/assets/service-account-token.png b/demo/assets/service-account-token.png
diff --git a/demo/assets/webapp.png b/demo/assets/webapp.png
diff --git a/demo/fileless_exec/kubernetes-manifest.yaml b/demo/fileless_exec/kubernetes-manifest.yaml
diff --git a/demo/fileless_exec/kubernetes-manifests.yaml b/demo/fileless_exec/kubernetes-manifests.yaml
diff --git a/demo/general_attack/commands.md b/demo/general_attack/commands.md
diff --git a/demo/general_attack/webapp/Containerfile b/demo/general_attack/webapp/Containerfile
diff --git a/demo/general_attack/webapp/index.html b/demo/general_attack/webapp/index.html
diff --git a/demo/general_attack/webapp/ping-app.yaml b/demo/general_attack/webapp/ping-app.yaml
diff --git a/demo/general_attack/webapp/ping.php b/demo/general_attack/webapp/ping.php
diff --git a/demo/malwares_image/Containerfile b/demo/malwares_image/Containerfile
diff --git a/demo/miner/Containerfile b/demo/miner/Containerfile
diff --git a/demo/miner/miner-pod.yaml b/demo/miner/miner-pod.yaml
diff --git a/go.mod b/go.mod
diff --git a/go.sum b/go.sum
@@ -594,8 +594,6 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby v27.0.2+incompatible h1:iYtGEjFi9lkX2m/Bop2H/peXzx3VtzmPlE9r0JHyH0s=
-github.com/moby/moby v27.0.2+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/moby v27.1.2+incompatible h1:vqOs4c7YktTdEBnPQNm0Q+M+IOuxxTCkrYJLBAVsEHQ=
 github.com/moby/moby v27.1.2+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=

diff --git a/go1.23.0.linux-amd64.tar.gz b/go1.23.0.linux-amd64.tar.gz
diff --git a/internal/validator/ebpf/verifier.go b/internal/validator/ebpf/verifier.go
diff --git a/internal/validator/validator.go b/internal/validator/validator.go
diff --git a/internal/validator/validator_test.go b/internal/validator/validator_test.go
diff --git a/main.go b/main.go
diff --git a/mocks/readfiles.go b/mocks/readfiles.go
diff --git a/mocks/readfiles_test.go b/mocks/readfiles_test.go
diff --git a/mocks/testdata/collection_applicationactivities.json b/mocks/testdata/collection_applicationactivities.json
diff --git a/mocks/testdata/collection_applicationprofiles.json b/mocks/testdata/collection_applicationprofiles.json
diff --git a/mocks/testdata/collection_deploy.json b/mocks/testdata/collection_deploy.json
diff --git a/mocks/testdata/collection_networkneighborhood.json b/mocks/testdata/collection_networkneighborhood.json
diff --git a/mocks/testdata/collection_pod.json b/mocks/testdata/collection_pod.json
diff --git a/mocks/testdata/collection_rs.json b/mocks/testdata/collection_rs.json
diff --git a/mocks/testdata/kubevuln_seccomp_config.json b/mocks/testdata/kubevuln_seccomp_config.json
diff --git a/mocks/testdata/nginx_applicationactivities.json b/mocks/testdata/nginx_applicationactivities.json
diff --git a/mocks/testdata/nginx_applicationprofiles.json b/mocks/testdata/nginx_applicationprofiles.json
diff --git a/mocks/testdata/nginx_deploy.json b/mocks/testdata/nginx_deploy.json
diff --git a/mocks/testdata/nginx_networkneighborhood.json b/mocks/testdata/nginx_networkneighborhood.json
diff --git a/mocks/testdata/nginx_pod.json b/mocks/testdata/nginx_pod.json
diff --git a/mocks/testdata/nginx_rs.json b/mocks/testdata/nginx_rs.json
diff --git a/mocks/testdata/nginx_seccomp_config.json b/mocks/testdata/nginx_seccomp_config.json
diff --git a/mocks/testdata/nginx_seccompprofiles.json b/mocks/testdata/nginx_seccompprofiles.json
diff --git a/pkg/applicationprofilemanager/applicationprofile_manager_interface.go b/pkg/applicationprofilemanager/applicationprofile_manager_interface.go
diff --git a/pkg/applicationprofilemanager/applicationprofile_manager_mock.go b/pkg/applicationprofilemanager/applicationprofile_manager_mock.go
diff --git a/pkg/applicationprofilemanager/v1/applicationprofile_manager.go b/pkg/applicationprofilemanager/v1/applicationprofile_manager.go
diff --git a/pkg/applicationprofilemanager/v1/applicationprofile_manager_test.go b/pkg/applicationprofilemanager/v1/applicationprofile_manager_test.go
diff --git a/pkg/config/config.go b/pkg/config/config.go
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
diff --git a/pkg/containerwatcher/container_watcher_interface.go b/pkg/containerwatcher/container_watcher_interface.go
diff --git a/pkg/containerwatcher/container_watcher_mock.go b/pkg/containerwatcher/container_watcher_mock.go
diff --git a/pkg/containerwatcher/v1/capabilities.go b/pkg/containerwatcher/v1/capabilities.go
diff --git a/pkg/containerwatcher/v1/common.go b/pkg/containerwatcher/v1/common.go
diff --git a/pkg/containerwatcher/v1/container_watcher.go b/pkg/containerwatcher/v1/container_watcher.go
diff --git a/pkg/containerwatcher/v1/container_watcher_private.go b/pkg/containerwatcher/v1/container_watcher_private.go
diff --git a/pkg/containerwatcher/v1/container_watcher_private_test.go b/pkg/containerwatcher/v1/container_watcher_private_test.go
diff --git a/pkg/containerwatcher/v1/dns.go b/pkg/containerwatcher/v1/dns.go
diff --git a/pkg/containerwatcher/v1/exec.go b/pkg/containerwatcher/v1/exec.go
diff --git a/pkg/containerwatcher/v1/hardlink.go b/pkg/containerwatcher/v1/hardlink.go
diff --git a/pkg/containerwatcher/v1/ig_k8sclient.go b/pkg/containerwatcher/v1/ig_k8sclient.go
diff --git a/pkg/containerwatcher/v1/network.go b/pkg/containerwatcher/v1/network.go
diff --git a/pkg/containerwatcher/v1/open.go b/pkg/containerwatcher/v1/open.go
diff --git a/pkg/containerwatcher/v1/open_test.go b/pkg/containerwatcher/v1/open_test.go
diff --git a/pkg/containerwatcher/v1/randomx.go b/pkg/containerwatcher/v1/randomx.go
diff --git a/pkg/containerwatcher/v1/ssh.go b/pkg/containerwatcher/v1/ssh.go
diff --git a/pkg/containerwatcher/v1/symlink.go b/pkg/containerwatcher/v1/symlink.go
diff --git a/pkg/containerwatcher/v1/syscall.go b/pkg/containerwatcher/v1/syscall.go
diff --git a/pkg/dnsmanager/dns_manager.go b/pkg/dnsmanager/dns_manager.go
diff --git a/pkg/dnsmanager/dns_manager_interface.go b/pkg/dnsmanager/dns_manager_interface.go
diff --git a/pkg/dnsmanager/dns_manager_mock.go b/pkg/dnsmanager/dns_manager_mock.go
diff --git a/pkg/dnsmanager/dns_manager_test.go b/pkg/dnsmanager/dns_manager_test.go
diff --git a/pkg/ebpf/gadgets/hardlink/tracer/bpf/hardlink.bpf.c b/pkg/ebpf/gadgets/hardlink/tracer/bpf/hardlink.bpf.c
diff --git a/pkg/ebpf/gadgets/hardlink/tracer/bpf/hardlink.h b/pkg/ebpf/gadgets/hardlink/tracer/bpf/hardlink.h
diff --git a/pkg/ebpf/gadgets/hardlink/tracer/gadget.go b/pkg/ebpf/gadgets/hardlink/tracer/gadget.go
diff --git a/pkg/ebpf/gadgets/hardlink/tracer/hardlink_bpfel.go b/pkg/ebpf/gadgets/hardlink/tracer/hardlink_bpfel.go
diff --git a/pkg/ebpf/gadgets/hardlink/tracer/hardlink_bpfel.o b/pkg/ebpf/gadgets/hardlink/tracer/hardlink_bpfel.o
diff --git a/pkg/ebpf/gadgets/hardlink/tracer/tracer.go b/pkg/ebpf/gadgets/hardlink/tracer/tracer.go
diff --git a/pkg/ebpf/gadgets/hardlink/types/types.go b/pkg/ebpf/gadgets/hardlink/types/types.go
diff --git a/pkg/ebpf/gadgets/randomx/tracer/bpf/randomx.bpf.c b/pkg/ebpf/gadgets/randomx/tracer/bpf/randomx.bpf.c
diff --git a/pkg/ebpf/gadgets/randomx/tracer/bpf/randomx.h b/pkg/ebpf/gadgets/randomx/tracer/bpf/randomx.h
diff --git a/pkg/ebpf/gadgets/randomx/tracer/gadget.go b/pkg/ebpf/gadgets/randomx/tracer/gadget.go
diff --git a/pkg/ebpf/gadgets/randomx/tracer/randomx_bpf.go b/pkg/ebpf/gadgets/randomx/tracer/randomx_bpf.go
diff --git a/pkg/ebpf/gadgets/randomx/tracer/randomx_bpf.o b/pkg/ebpf/gadgets/randomx/tracer/randomx_bpf.o
diff --git a/pkg/ebpf/gadgets/randomx/tracer/tracer.go b/pkg/ebpf/gadgets/randomx/tracer/tracer.go
diff --git a/pkg/ebpf/gadgets/randomx/types/types.go b/pkg/ebpf/gadgets/randomx/types/types.go
diff --git a/pkg/ebpf/gadgets/ssh/tracer/bpf/ssh.bpf.c b/pkg/ebpf/gadgets/ssh/tracer/bpf/ssh.bpf.c
diff --git a/pkg/ebpf/gadgets/ssh/tracer/bpf/ssh.h b/pkg/ebpf/gadgets/ssh/tracer/bpf/ssh.h
diff --git a/pkg/ebpf/gadgets/ssh/tracer/ssh_bpfel.go b/pkg/ebpf/gadgets/ssh/tracer/ssh_bpfel.go
diff --git a/pkg/ebpf/gadgets/ssh/tracer/ssh_bpfel.o b/pkg/ebpf/gadgets/ssh/tracer/ssh_bpfel.o
diff --git a/pkg/ebpf/gadgets/ssh/tracer/tracer.go b/pkg/ebpf/gadgets/ssh/tracer/tracer.go
diff --git a/pkg/ebpf/gadgets/ssh/types/types.go b/pkg/ebpf/gadgets/ssh/types/types.go
diff --git a/pkg/ebpf/gadgets/symlink/tracer/bpf/symlink.bpf.c b/pkg/ebpf/gadgets/symlink/tracer/bpf/symlink.bpf.c
diff --git a/pkg/ebpf/gadgets/symlink/tracer/bpf/symlink.h b/pkg/ebpf/gadgets/symlink/tracer/bpf/symlink.h
diff --git a/pkg/ebpf/gadgets/symlink/tracer/gadget.go b/pkg/ebpf/gadgets/symlink/tracer/gadget.go
diff --git a/pkg/ebpf/gadgets/symlink/tracer/symlink_bpfel.go b/pkg/ebpf/gadgets/symlink/tracer/symlink_bpfel.go
diff --git a/pkg/ebpf/gadgets/symlink/tracer/symlink_bpfel.o b/pkg/ebpf/gadgets/symlink/tracer/symlink_bpfel.o
diff --git a/pkg/ebpf/gadgets/symlink/tracer/test/program.c b/pkg/ebpf/gadgets/symlink/tracer/test/program.c
diff --git a/pkg/ebpf/gadgets/symlink/tracer/tracer.go b/pkg/ebpf/gadgets/symlink/tracer/tracer.go
diff --git a/pkg/ebpf/gadgets/symlink/types/types.go b/pkg/ebpf/gadgets/symlink/types/types.go
diff --git a/pkg/ebpf/include/amd64/vmlinux.h b/pkg/ebpf/include/amd64/vmlinux.h
diff --git a/pkg/ebpf/include/arm64/vmlinux.h b/pkg/ebpf/include/arm64/vmlinux.h
diff --git a/pkg/ebpf/include/buffer.h b/pkg/ebpf/include/buffer.h
diff --git a/pkg/ebpf/include/filesystem.h b/pkg/ebpf/include/filesystem.h
diff --git a/pkg/ebpf/include/macros.h b/pkg/ebpf/include/macros.h
diff --git a/pkg/ebpf/include/mntns.h b/pkg/ebpf/include/mntns.h
diff --git a/pkg/ebpf/include/mntns_filter.h b/pkg/ebpf/include/mntns_filter.h
diff --git a/pkg/ebpf/include/sockets-map.h b/pkg/ebpf/include/sockets-map.h
diff --git a/pkg/ebpf/include/types.h b/pkg/ebpf/include/types.h
diff --git a/pkg/exporters/README.md b/pkg/exporters/README.md
diff --git a/pkg/exporters/alert_manager.go b/pkg/exporters/alert_manager.go
diff --git a/pkg/exporters/alert_manager_test.go b/pkg/exporters/alert_manager_test.go
diff --git a/pkg/exporters/csv_exporter.go b/pkg/exporters/csv_exporter.go
diff --git a/pkg/exporters/csv_exporter_test.go b/pkg/exporters/csv_exporter_test.go
diff --git a/pkg/exporters/exporter.go b/pkg/exporters/exporter.go
diff --git a/pkg/exporters/exporters_bus.go b/pkg/exporters/exporters_bus.go
diff --git a/pkg/exporters/http_exporter.go b/pkg/exporters/http_exporter.go
diff --git a/pkg/exporters/http_exporter_test.go b/pkg/exporters/http_exporter_test.go
diff --git a/pkg/exporters/stdout_exporter.go b/pkg/exporters/stdout_exporter.go
diff --git a/pkg/exporters/stdout_exporter_test.go b/pkg/exporters/stdout_exporter_test.go
diff --git a/pkg/exporters/syslog_exporter.go b/pkg/exporters/syslog_exporter.go
diff --git a/pkg/exporters/syslog_exporter_test.go b/pkg/exporters/syslog_exporter_test.go
diff --git a/pkg/exporters/utils.go b/pkg/exporters/utils.go
diff --git a/pkg/exporters/utils_test.go b/pkg/exporters/utils_test.go
diff --git a/pkg/filehandler/filehandler_interface.go b/pkg/filehandler/filehandler_interface.go
diff --git a/pkg/filehandler/v1/filehandler_test.go b/pkg/filehandler/v1/filehandler_test.go
diff --git a/pkg/filehandler/v1/inmemory.go b/pkg/filehandler/v1/inmemory.go
diff --git a/pkg/healthmanager/health_manager.go b/pkg/healthmanager/health_manager.go
diff --git a/pkg/k8sclient/k8sclient_interface.go b/pkg/k8sclient/k8sclient_interface.go
diff --git a/pkg/k8sclient/k8sclient_mock.go b/pkg/k8sclient/k8sclient_mock.go
diff --git a/pkg/malwaremanager/malware_manager_interface.go b/pkg/malwaremanager/malware_manager_interface.go
diff --git a/pkg/malwaremanager/malwaremanager_mock.go b/pkg/malwaremanager/malwaremanager_mock.go
diff --git a/pkg/malwaremanager/v1/clamav/clamav.go b/pkg/malwaremanager/v1/clamav/clamav.go
diff --git a/pkg/malwaremanager/v1/clamav/exec.go b/pkg/malwaremanager/v1/clamav/exec.go
diff --git a/pkg/malwaremanager/v1/clamav/open.go b/pkg/malwaremanager/v1/clamav/open.go
diff --git a/pkg/malwaremanager/v1/malware_manager.go b/pkg/malwaremanager/v1/malware_manager.go
diff --git a/pkg/malwaremanager/v1/types/malwareresult.go b/pkg/malwaremanager/v1/types/malwareresult.go
diff --git a/pkg/metricsmanager/metrics_manager_interface.go b/pkg/metricsmanager/metrics_manager_interface.go
diff --git a/pkg/metricsmanager/metrics_manager_mock.go b/pkg/metricsmanager/metrics_manager_mock.go
diff --git a/pkg/metricsmanager/prometheus/prometheus.go b/pkg/metricsmanager/prometheus/prometheus.go
diff --git a/pkg/networkmanager/network_event.go b/pkg/networkmanager/network_event.go
diff --git a/pkg/networkmanager/network_event_test.go b/pkg/networkmanager/network_event_test.go
diff --git a/pkg/networkmanager/network_manager_interface.go b/pkg/networkmanager/network_manager_interface.go
diff --git a/pkg/networkmanager/network_manager_mock.go b/pkg/networkmanager/network_manager_mock.go
diff --git a/pkg/networkmanager/network_neighbors.go b/pkg/networkmanager/network_neighbors.go
diff --git a/pkg/networkmanager/network_neighbors_test.go b/pkg/networkmanager/network_neighbors_test.go
diff --git a/pkg/networkmanager/testdata/cronjob.json b/pkg/networkmanager/testdata/cronjob.json
diff --git a/pkg/networkmanager/testdata/daemonset.json b/pkg/networkmanager/testdata/daemonset.json
diff --git a/pkg/networkmanager/testdata/deployment.json b/pkg/networkmanager/testdata/deployment.json
diff --git a/pkg/networkmanager/testdata/pod.json b/pkg/networkmanager/testdata/pod.json
diff --git a/pkg/networkmanager/testdata/testdata.go b/pkg/networkmanager/testdata/testdata.go
diff --git a/pkg/networkmanager/v2/network_manager.go b/pkg/networkmanager/v2/network_manager.go
diff --git a/pkg/networkmanager/v2/network_manager_test.go b/pkg/networkmanager/v2/network_manager_test.go
diff --git a/pkg/nodeprofilemanager/nodeprofile_manager_interface.go b/pkg/nodeprofilemanager/nodeprofile_manager_interface.go
diff --git a/pkg/nodeprofilemanager/nodeprofile_manager_mock.go b/pkg/nodeprofilemanager/nodeprofile_manager_mock.go
diff --git a/pkg/nodeprofilemanager/v1/nodeprofile_manager.go b/pkg/nodeprofilemanager/v1/nodeprofile_manager.go
diff --git a/pkg/objectcache/applicationprofilecache/applicationprofilecache.go b/pkg/objectcache/applicationprofilecache/applicationprofilecache.go
diff --git a/pkg/objectcache/applicationprofilecache/applicationprofilecache_test.go b/pkg/objectcache/applicationprofilecache/applicationprofilecache_test.go
diff --git a/pkg/objectcache/applicationprofilecache_interface.go b/pkg/objectcache/applicationprofilecache_interface.go
diff --git a/pkg/objectcache/helpers.go b/pkg/objectcache/helpers.go
diff --git a/pkg/objectcache/helpers_test.go b/pkg/objectcache/helpers_test.go
diff --git a/pkg/objectcache/k8scache/k8scache.go b/pkg/objectcache/k8scache/k8scache.go
diff --git a/pkg/objectcache/k8scache/k8scache_test.go b/pkg/objectcache/k8scache/k8scache_test.go
diff --git a/pkg/objectcache/k8scache_interface.go b/pkg/objectcache/k8scache_interface.go
diff --git a/pkg/objectcache/networkneighborhoodcache/networkneighborhoodcache.go b/pkg/objectcache/networkneighborhoodcache/networkneighborhoodcache.go
diff --git a/pkg/objectcache/networkneighborhoodcache/networkneighborhoodcache_test.go b/pkg/objectcache/networkneighborhoodcache/networkneighborhoodcache_test.go
diff --git a/pkg/objectcache/networkneighborhoodcache_interface.go b/pkg/objectcache/networkneighborhoodcache_interface.go
diff --git a/pkg/objectcache/objectcache_interface.go b/pkg/objectcache/objectcache_interface.go
diff --git a/pkg/objectcache/v1/objectcache.go b/pkg/objectcache/v1/objectcache.go
diff --git a/pkg/objectcache/v1/objectcache_test.go b/pkg/objectcache/v1/objectcache_test.go
diff --git a/pkg/relevancymanager/relevancy_manager_interface.go b/pkg/relevancymanager/relevancy_manager_interface.go
diff --git a/pkg/relevancymanager/relevancy_manager_mock.go b/pkg/relevancymanager/relevancy_manager_mock.go
diff --git a/pkg/relevancymanager/v1/relevancy_manager.go b/pkg/relevancymanager/v1/relevancy_manager.go
diff --git a/pkg/relevancymanager/v1/relevancy_manager_test.go b/pkg/relevancymanager/v1/relevancy_manager_test.go
diff --git a/pkg/relevancymanager/v1/testdata/nginx-syft-crd.json b/pkg/relevancymanager/v1/testdata/nginx-syft-crd.json
diff --git a/pkg/relevancymanager/v1/testdata/nginx-syft-filtered.json b/pkg/relevancymanager/v1/testdata/nginx-syft-filtered.json
diff --git a/pkg/rulebindingmanager/README.md b/pkg/rulebindingmanager/README.md
diff --git a/pkg/rulebindingmanager/cache/cache.go b/pkg/rulebindingmanager/cache/cache.go
diff --git a/pkg/rulebindingmanager/cache/cache_test.go b/pkg/rulebindingmanager/cache/cache_test.go
diff --git a/pkg/rulebindingmanager/cache/helpers.go b/pkg/rulebindingmanager/cache/helpers.go
diff --git a/pkg/rulebindingmanager/cache/helpers_test.go b/pkg/rulebindingmanager/cache/helpers_test.go
diff --git a/pkg/rulebindingmanager/notifier.go b/pkg/rulebindingmanager/notifier.go
diff --git a/pkg/rulebindingmanager/rulebindingmanager_interface.go b/pkg/rulebindingmanager/rulebindingmanager_interface.go
diff --git a/pkg/rulebindingmanager/rulebindingmanager_mock.go b/pkg/rulebindingmanager/rulebindingmanager_mock.go
diff --git a/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-all-pods.yaml b/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-all-pods.yaml
diff --git a/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-for-app-nginx-default-ns.yaml b/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-for-app-nginx-default-ns.yaml
diff --git a/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-for-app-nginx.yaml b/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-for-app-nginx.yaml
diff --git a/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-for-default-ns.yaml b/pkg/rulebindingmanager/testdata/rulebindingsfiles/all-rules-for-default-ns.yaml
diff --git a/pkg/rulebindingmanager/testdata/rulebindingsfiles/no-rules-for-app-nginx-default-ns.yaml b/pkg/rulebindingmanager/testdata/rulebindingsfiles/no-rules-for-app-nginx-default-ns.yaml
diff --git a/pkg/rulebindingmanager/testdata/rulebindingsfiles/single-rule-for-app-nginx-default-ns.yaml b/pkg/rulebindingmanager/testdata/rulebindingsfiles/single-rule-for-app-nginx-default-ns.yaml
diff --git a/pkg/rulebindingmanager/testdata/ruleparamsfiles/rule-file-params.yaml b/pkg/rulebindingmanager/testdata/ruleparamsfiles/rule-file-params.yaml
diff --git a/pkg/rulebindingmanager/testdata/ruleparamsfiles/rule-ssh-params.yaml b/pkg/rulebindingmanager/testdata/ruleparamsfiles/rule-ssh-params.yaml
diff --git a/pkg/rulebindingmanager/types/api.go b/pkg/rulebindingmanager/types/api.go
diff --git a/pkg/rulebindingmanager/types/v1/README.md b/pkg/rulebindingmanager/types/v1/README.md
diff --git a/pkg/rulebindingmanager/types/v1/api.go b/pkg/rulebindingmanager/types/v1/api.go
diff --git a/pkg/rulebindingmanager/types/v1/types.go b/pkg/rulebindingmanager/types/v1/types.go
diff --git a/pkg/ruleengine/ruleengine_interface.go b/pkg/ruleengine/ruleengine_interface.go
diff --git a/pkg/ruleengine/ruleengine_mock.go b/pkg/ruleengine/ruleengine_mock.go
diff --git a/pkg/ruleengine/types/types.go b/pkg/ruleengine/types/types.go
diff --git a/pkg/ruleengine/v1/README.md b/pkg/ruleengine/v1/README.md
diff --git a/pkg/ruleengine/v1/_factory_test.go b/pkg/ruleengine/v1/_factory_test.go
diff --git a/pkg/ruleengine/v1/factory.go b/pkg/ruleengine/v1/factory.go
@@ -34,6 +34,8 @@ func NewRuleCreator() *RuleCreatorImpl {
 			R1010SymlinkCreatedOverSensitiveFileRuleDescriptor,
 			R1011LdPreloadHookRuleDescriptor,
 			R1012HardlinkCreatedOverSensitiveFileRuleDescriptor,
+			R1013CryptoMiningFilesAccessRuleDescriptor,
+			R1014CryptoMinerDetectedRuleDescriptor,
 		},
 	}
 }

diff --git a/pkg/ruleengine/v1/failureobj.go b/pkg/ruleengine/v1/failureobj.go
diff --git a/pkg/ruleengine/v1/helpers.go b/pkg/ruleengine/v1/helpers.go
diff --git a/pkg/ruleengine/v1/mock.go b/pkg/ruleengine/v1/mock.go
diff --git a/pkg/ruleengine/v1/r0001_unexpected_process_launched.go b/pkg/ruleengine/v1/r0001_unexpected_process_launched.go
@@ -76,6 +76,7 @@ func (rule *R0001UnexpectedProcessLaunched) generatePatchCommand(event *tracerex
 }
 
 func (rule *R0001UnexpectedProcessLaunched) ProcessEvent(eventType utils.EventType, event interface{}, objectCache objectcache.ObjectCache) ruleengine.RuleFailure {
+
 	if eventType != utils.ExecveEventType {
 		return nil
 	}

diff --git a/pkg/ruleengine/v1/r0001_unexpected_process_launched_test.go b/pkg/ruleengine/v1/r0001_unexpected_process_launched_test.go
diff --git a/pkg/ruleengine/v1/r0002_unexpected_file_access.go b/pkg/ruleengine/v1/r0002_unexpected_file_access.go
diff --git a/pkg/ruleengine/v1/r0002_unexpected_file_access_test.go b/pkg/ruleengine/v1/r0002_unexpected_file_access_test.go
diff --git a/pkg/ruleengine/v1/r0003_unexpected_system_call.go b/pkg/ruleengine/v1/r0003_unexpected_system_call.go
diff --git a/pkg/ruleengine/v1/r0003_unexpected_system_call_test.go b/pkg/ruleengine/v1/r0003_unexpected_system_call_test.go
diff --git a/pkg/ruleengine/v1/r0004_unexpected_capability_used.go b/pkg/ruleengine/v1/r0004_unexpected_capability_used.go
diff --git a/pkg/ruleengine/v1/r0004_unexpected_capability_used_test.go b/pkg/ruleengine/v1/r0004_unexpected_capability_used_test.go
diff --git a/pkg/ruleengine/v1/r0005_unexpected_domain_request.go b/pkg/ruleengine/v1/r0005_unexpected_domain_request.go
diff --git a/pkg/ruleengine/v1/r0005_unexpected_domain_request_test.go b/pkg/ruleengine/v1/r0005_unexpected_domain_request_test.go
diff --git a/pkg/ruleengine/v1/r0006_unexpected_service_account_token_access.go b/pkg/ruleengine/v1/r0006_unexpected_service_account_token_access.go
diff --git a/pkg/ruleengine/v1/r0006_unexpected_service_account_token_access_test.go b/pkg/ruleengine/v1/r0006_unexpected_service_account_token_access_test.go
diff --git a/pkg/ruleengine/v1/r0007_kubernetes_client_executed.go b/pkg/ruleengine/v1/r0007_kubernetes_client_executed.go
diff --git a/pkg/ruleengine/v1/r0007_kubernetes_client_executed_test.go b/pkg/ruleengine/v1/r0007_kubernetes_client_executed_test.go
diff --git a/pkg/ruleengine/v1/r0008_read_env_variables_procfs.go b/pkg/ruleengine/v1/r0008_read_env_variables_procfs.go
diff --git a/pkg/ruleengine/v1/r0008_read_env_variables_procfs_test.go b/pkg/ruleengine/v1/r0008_read_env_variables_procfs_test.go
diff --git a/pkg/ruleengine/v1/r0009_ebpf_program_load.go b/pkg/ruleengine/v1/r0009_ebpf_program_load.go
diff --git a/pkg/ruleengine/v1/r0009_ebpf_program_load_test.go b/pkg/ruleengine/v1/r0009_ebpf_program_load_test.go
diff --git a/pkg/ruleengine/v1/r0010_unexpected_sensitive_file_access.go b/pkg/ruleengine/v1/r0010_unexpected_sensitive_file_access.go
diff --git a/pkg/ruleengine/v1/r0010_unexpected_sensitive_file_access_test.go b/pkg/ruleengine/v1/r0010_unexpected_sensitive_file_access_test.go
diff --git a/pkg/ruleengine/v1/r1000_exec_from_malicious_source.go b/pkg/ruleengine/v1/r1000_exec_from_malicious_source.go
diff --git a/pkg/ruleengine/v1/r1000_exec_from_malicious_source_test.go b/pkg/ruleengine/v1/r1000_exec_from_malicious_source_test.go
diff --git a/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image.go b/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image.go
diff --git a/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image_test.go b/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image_test.go
diff --git a/pkg/ruleengine/v1/r1002_load_kernel_module.go b/pkg/ruleengine/v1/r1002_load_kernel_module.go
diff --git a/pkg/ruleengine/v1/r1002_load_kernel_module_test.go b/pkg/ruleengine/v1/r1002_load_kernel_module_test.go
diff --git a/pkg/ruleengine/v1/r1003_malicious_ssh_connection.go b/pkg/ruleengine/v1/r1003_malicious_ssh_connection.go
diff --git a/pkg/ruleengine/v1/r1003_malicious_ssh_connection_test.go b/pkg/ruleengine/v1/r1003_malicious_ssh_connection_test.go
diff --git a/pkg/ruleengine/v1/r1004_exec_from_mount.go b/pkg/ruleengine/v1/r1004_exec_from_mount.go
diff --git a/pkg/ruleengine/v1/r1004_exec_from_mount_test.go b/pkg/ruleengine/v1/r1004_exec_from_mount_test.go
diff --git a/pkg/ruleengine/v1/r1005_fileless_execution.go b/pkg/ruleengine/v1/r1005_fileless_execution.go
diff --git a/pkg/ruleengine/v1/r1005_fileless_execution_test.go b/pkg/ruleengine/v1/r1005_fileless_execution_test.go
diff --git a/pkg/ruleengine/v1/r1006_unshare_system_call.go b/pkg/ruleengine/v1/r1006_unshare_system_call.go
diff --git a/pkg/ruleengine/v1/r1006_unshare_system_call_test.go b/pkg/ruleengine/v1/r1006_unshare_system_call_test.go
diff --git a/pkg/ruleengine/v1/r1007_xmr_crypto_mining.go b/pkg/ruleengine/v1/r1007_xmr_crypto_mining.go
diff --git a/pkg/ruleengine/v1/r1007_xmr_crypto_mining_test.go b/pkg/ruleengine/v1/r1007_xmr_crypto_mining_test.go
diff --git a/...leengine/v1/r1008_crypto_mining_domain.go → ...eengine/v1/r1008_crypto_mining_domains.go b/...leengine/v1/r1008_crypto_mining_domain.go → ...eengine/v1/r1008_crypto_mining_domains.go
@@ -17,114 +17,6 @@ const (
 	R1008Name = "Crypto Mining Domain Communication"
 )
 
-var commonlyUsedCryptoMinersDomains = []string{
-	"2cryptocalc.com.",
-	"2miners.com.",
-	"antpool.com.",
-	"asia1.ethpool.org.",
-	"bohemianpool.com.",
-	"botbox.dev.",
-	"btm.antpool.com.",
-	"c3pool.com.",
-	"c4pool.org.",
-	"ca.minexmr.com.",
-	"cn.stratum.slushpool.com.",
-	"dash.antpool.com.",
-	"data.miningpoolstats.stream.",
-	"de.minexmr.com.",
-	"eth-ar.dwarfpool.com.",
-	"eth-asia.dwarfpool.com.",
-	"eth-asia1.nanopool.org.",
-	"eth-au.dwarfpool.com.",
-	"eth-au1.nanopool.org.",
-	"eth-br.dwarfpool.com.",
-	"eth-cn.dwarfpool.com.",
-	"eth-cn2.dwarfpool.com.",
-	"eth-eu.dwarfpool.com.",
-	"eth-eu1.nanopool.org.",
-	"eth-eu2.nanopool.org.",
-	"eth-hk.dwarfpool.com.",
-	"eth-jp1.nanopool.org.",
-	"eth-ru.dwarfpool.com.",
-	"eth-ru2.dwarfpool.com.",
-	"eth-sg.dwarfpool.com.",
-	"eth-us-east1.nanopool.org.",
-	"eth-us-west1.nanopool.org.",
-	"eth-us.dwarfpool.com.",
-	"eth-us2.dwarfpool.com.",
-	"eth.antpool.com.",
-	"eu.stratum.slushpool.com.",
-	"eu1.ethermine.org.",
-	"eu1.ethpool.org.",
-	"fastpool.xyz.",
-	"fr.minexmr.com.",
-	"kriptokyng.com.",
-	"mine.moneropool.com.",
-	"mine.xmrpool.net.",
-	"miningmadness.com.",
-	"monero.cedric-crispin.com.",
-	"monero.crypto-pool.fr.",
-	"monero.fairhash.org.",
-	"monero.hashvault.pro.",
-	"monero.herominers.com.",
-	"monerod.org.",
-	"monerohash.com.",
-	"moneroocean.stream.",
-	"monerop.com.",
-	"multi-pools.com.",
-	"p2pool.io.",
-	"pool.kryptex.com.",
-	"pool.minexmr.com.",
-	"pool.monero.hashvault.pro.",
-	"pool.rplant.xyz.",
-	"pool.supportxmr.com.",
-	"pool.xmr.pt.",
-	"prohashing.com.",
-	"rx.unmineable.com.",
-	"sg.minexmr.com.",
-	"sg.stratum.slushpool.com.",
-	"skypool.org.",
-	"solo-xmr.2miners.com.",
-	"ss.antpool.com.",
-	"stratum-btm.antpool.com.",
-	"stratum-dash.antpool.com.",
-	"stratum-eth.antpool.com.",
-	"stratum-ltc.antpool.com.",
-	"stratum-xmc.antpool.com.",
-	"stratum-zec.antpool.com.",
-	"stratum.antpool.com.",
-	"supportxmr.com.",
-	"trustpool.cc.",
-	"us-east.stratum.slushpool.com.",
-	"us1.ethermine.org.",
-	"us1.ethpool.org.",
-	"us2.ethermine.org.",
-	"us2.ethpool.org.",
-	"web.xmrpool.eu.",
-	"www.domajorpool.com.",
-	"www.dxpool.com.",
-	"www.mining-dutch.nl.",
-	"xmc.antpool.com.",
-	"xmr-asia1.nanopool.org.",
-	"xmr-au1.nanopool.org.",
-	"xmr-eu1.nanopool.org.",
-	"xmr-eu2.nanopool.org.",
-	"xmr-jp1.nanopool.org.",
-	"xmr-us-east1.nanopool.org.",
-	"xmr-us-west1.nanopool.org.",
-	"xmr.2miners.com.",
-	"xmr.crypto-pool.fr.",
-	"xmr.gntl.uk.",
-	"xmr.nanopool.org.",
-	"xmr.pool-pay.com.",
-	"xmr.pool.minergate.com.",
-	"xmr.solopool.org.",
-	"xmr.volt-mine.com.",
-	"xmr.zeropool.io.",
-	"zec.antpool.com.",
-	"zergpool.com.",
-}
-
 var R1008CryptoMiningDomainCommunicationRuleDescriptor = RuleDescriptor{
 	ID:          R1008ID,
 	Name:        R1008Name,
@@ -163,12 +55,14 @@ func (rule *R1008CryptoMiningDomainCommunication) DeleteRule() {
 }
 
 func (rule *R1008CryptoMiningDomainCommunication) ProcessEvent(eventType utils.EventType, event interface{}, _ objectcache.ObjectCache) ruleengine.RuleFailure {
+
 	if eventType != utils.DnsEventType {
 		return nil
 	}
 
 	if dnsEvent, ok := event.(*tracerdnstype.Event); ok {
-		if slices.Contains(commonlyUsedCryptoMinersDomains, dnsEvent.DNSName) {
+
+		if slices.Contains(utils.CommonlyUsedCryptoMinersDomains, dnsEvent.DNSName) {
 			ruleFailure := GenericRuleFailure{
 				BaseRuntimeAlert: apitypes.BaseRuntimeAlert{
 					AlertName:      rule.Name(),

diff --git a/...ine/v1/r1008_crypto_mining_domain_test.go → ...ne/v1/r1008_crypto_mining_domains_test.go b/...ine/v1/r1008_crypto_mining_domain_test.go → ...ne/v1/r1008_crypto_mining_domains_test.go
diff --git a/pkg/ruleengine/v1/r1009_crypto_mining_port.go b/pkg/ruleengine/v1/r1009_crypto_mining_port.go
diff --git a/pkg/ruleengine/v1/r1009_crypto_mining_port_test.go b/pkg/ruleengine/v1/r1009_crypto_mining_port_test.go
diff --git a/pkg/ruleengine/v1/r1010_symlink_created_over_sensitive_file.go b/pkg/ruleengine/v1/r1010_symlink_created_over_sensitive_file.go
diff --git a/pkg/ruleengine/v1/r1010_symlink_created_over_sensitive_file_test.go b/pkg/ruleengine/v1/r1010_symlink_created_over_sensitive_file_test.go
diff --git a/pkg/ruleengine/v1/r1011_ld_preload_hook.go b/pkg/ruleengine/v1/r1011_ld_preload_hook.go
diff --git a/pkg/ruleengine/v1/r1011_ld_preload_hook_test.go b/pkg/ruleengine/v1/r1011_ld_preload_hook_test.go
diff --git a/pkg/ruleengine/v1/r1012_hardlink_created_over_sensitive_file.go b/pkg/ruleengine/v1/r1012_hardlink_created_over_sensitive_file.go
diff --git a/pkg/ruleengine/v1/r1012_hardlink_created_over_sensitive_file_test.go b/pkg/ruleengine/v1/r1012_hardlink_created_over_sensitive_file_test.go
diff --git a/pkg/ruleengine/v1/r1013_crypto_mining_files.go b/pkg/ruleengine/v1/r1013_crypto_mining_files.go
@@ -0,0 +1,103 @@
+package ruleengine
+
+import (
+	"fmt"
+	"strings"
+	"slices"
+
+	traceropentype "github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/trace/open/types"
+	"github.com/kubescape/node-agent/pkg/objectcache"
+	"github.com/kubescape/node-agent/pkg/ruleengine"
+	"github.com/kubescape/node-agent/pkg/utils"
+
+	apitypes "github.com/armosec/armoapi-go/armotypes"
+)
+
+const (
+	R1013ID   = "R1013"
+	R1013Name = "Crypto Mining files access"
+)
+
+var R1013CryptoMiningFilesAccessRuleDescriptor = RuleDescriptor{
+	ID:          R1013ID,
+	Name:        R1013Name,
+	Description: "Detecting Crypto miners communication by files access",
+	Tags:        []string{"crypto", "miners", "malicious", "whitelisted"},
+	Priority:    RulePriorityHigh,
+	Requirements: &RuleRequirements{
+		EventTypes: []utils.EventType{
+			utils.OpenEventType,
+		},
+	},
+	RuleCreationFunc: func() ruleengine.RuleEvaluator {
+		return CreateRuleR1013CryptoMiningFilesAccess()
+	},
+}
+var _ ruleengine.RuleEvaluator = (*R1013CryptoMiningFilesAccess)(nil)
+
+type R1013CryptoMiningFilesAccess struct {
+	BaseRule
+}
+
+func CreateRuleR1013CryptoMiningFilesAccess() *R1013CryptoMiningFilesAccess {
+	return &R1013CryptoMiningFilesAccess{}
+}
+func (rule *R1013CryptoMiningFilesAccess) Name() string {
+	return R1013Name
+}
+
+func (rule *R1013CryptoMiningFilesAccess) ID() string {
+	return R1013ID
+}
+
+func (rule *R1013CryptoMiningFilesAccess) DeleteRule() {
+}
+
+func (rule *R1013CryptoMiningFilesAccess) ProcessEvent(eventType utils.EventType, event interface{}, objCache objectcache.ObjectCache) ruleengine.RuleFailure {
+	if eventType != utils.OpenEventType {
+		return nil
+	}
+
+	openEvent, ok := event.(*traceropentype.Event)
+	if !ok {
+		return nil
+	}
+
+	if slices.Contains(utils.CryptoMiningFilesAccessPathsPrefix, openEvent.FullPath) {
+
+	ruleFailure := GenericRuleFailure{
+		BaseRuntimeAlert: apitypes.BaseRuntimeAlert{
+			AlertName:      rule.Name(),
+			InfectedPID:    openEvent.Pid,
+			FixSuggestions: "If this is a legitimate action, please consider removing this workload from the binding of this rule.",
+			Severity:       R1013CryptoMiningFilesAccessRuleDescriptor.Priority,
+		},
+		RuntimeProcessDetails: apitypes.ProcessTree{
+			ProcessTree: apitypes.Process{
+				Comm: openEvent.Comm,
+				Gid:  &openEvent.Gid,
+				PID:  openEvent.Pid,
+				Uid:  &openEvent.Uid,
+			},
+			ContainerID: openEvent.Runtime.ContainerID,
+		},
+		TriggerEvent: openEvent.Event,
+		RuleAlert: apitypes.RuleAlert{
+			RuleDescription: fmt.Sprintf("Unexpected access to crypto mining-related file: %s with flags: %s in: %s", openEvent.FullPath, strings.Join(openEvent.Flags, ","), openEvent.GetContainer()),
+		},
+		RuntimeAlertK8sDetails: apitypes.RuntimeAlertK8sDetails{
+			PodName: openEvent.GetPod(),
+		},
+		RuleID: rule.ID(),
+	}
+
+	return &ruleFailure
+}
+return nil
+}
+
+func (rule *R1013CryptoMiningFilesAccess) Requirements() ruleengine.RuleSpec {
+	return &RuleRequirements{
+		EventTypes: R1013CryptoMiningFilesAccessRuleDescriptor.Requirements.RequiredEventTypes(),
+	}
+}
diff --git a/pkg/ruleengine/v1/r1013_crypto_mining_files_test.go b/pkg/ruleengine/v1/r1013_crypto_mining_files_test.go
@@ -0,0 +1,68 @@
+package ruleengine
+
+import (
+	"testing"
+
+	"github.com/kubescape/node-agent/pkg/utils"
+
+	traceropentype "github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/trace/open/types"
+	"github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1"
+
+	eventtypes "github.com/inspektor-gadget/inspektor-gadget/pkg/types"
+)
+
+func TestR1013UnexpectedServiceAccountTokenMount(t *testing.T) {
+	// Create a new rule
+	r := CreateRuleR1013CryptoMiningFilesAccess()
+	// Assert r is not nil
+	if r == nil {
+		t.Errorf("Expected r to not be nil")
+	}
+
+	// Create a file access event
+	e := &traceropentype.Event{
+		Event: eventtypes.Event{
+			CommonData: eventtypes.CommonData{
+				K8s: eventtypes.K8sMetadata{
+					BasicK8sMetadata: eventtypes.BasicK8sMetadata{
+						ContainerName: "test",
+					},
+				},
+			},
+		},
+		Path:     "/test",
+		FullPath: "/test",
+		Flags:    []string{"O_RDONLY"},
+	}
+
+	// Test with nil appProfileAccess
+	ruleResult := r.ProcessEvent(utils.OpenEventType, e, &RuleObjectCacheMock{})
+	if ruleResult != nil {
+		t.Errorf("Expected ruleResult to not be nil since no appProfile")
+		return
+	}
+
+	// Test with whitelisted file
+	e.FullPath = "/proc/meminfo/asdasd"
+	objCache := RuleObjectCacheMock{}
+	profile := objCache.ApplicationProfileCache().GetApplicationProfile("test")
+	if profile == nil {
+		profile = &v1beta1.ApplicationProfile{}
+		profile.Spec.Containers = append(profile.Spec.Containers, v1beta1.ApplicationProfileContainer{
+			Name: "test",
+			Opens: []v1beta1.OpenCalls{
+				{
+					Path:  "/proc/meminfo",
+					Flags: []string{"O_RDONLY"},
+				},
+			},
+		})
+
+		objCache.SetApplicationProfile(profile)
+	}
+
+	ruleResult = r.ProcessEvent(utils.OpenEventType, e, &objCache)
+	if ruleResult != nil {
+		t.Errorf("Expected ruleResult to be nil since file is whitelisted")
+	}
+}
-Original file line number
+Diff line change
@@ Expand Up @@
     }
     func (rule *R0001UnexpectedProcessLaunched) ProcessEvent(eventType utils.EventType, event interface{}, objectCache objectcache.ObjectCache) ruleengine.RuleFailure {
     	if eventType != utils.ExecveEventType {
     		return nil
     	}
@@ Expand Down @@