Pack

`network-exfil`

IMDS, pipe-to-shell, and obvious secret egress — deny.

Default effect: deny

Extend in policy

extends:
  - pack: network-exfil

Complements dangerous-defaults curl|sh and secrets-safe path exfil. Denies cloud instance metadata (169.254.169.254), download-piped-to-shell, and obvious credential POST patterns.

All packs · Policy docs · Source YAML