new(rules): Basic Interactive Reconnaissance

[incertum]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

Proposed rule maturity level

Uncomment one (or more) /area <> lines (only for PRs that add or modify rules):

/area maturity-stable

/area maturity-incubating

/area maturity-sandbox

/area maturity-deprecated

What this PR does / why we need it:

This is another basic auditing rule that can serve as valuable example for adopters, see https://github.com/falcosecurity/rules/issues/138.

Note, this rule is incompatible with Falco 0.35 ... re bumping the rules engine version, we can either do this here or in the memfd + exec PR (@loresuso, @darryk10 any preferences?). In addition I have a question @leogr we would bump the required engine version in all rules files? this would seem easier per release.

More context around the new process group leader fields was provided in this libs PR: https://github.com/falcosecurity/libs/pull/1178

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

[poiana]

LGTM label has been added.

Git tree hash: 33d15c68eea65c9ebfc06f35f15bbfb76bf1ff04

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: darryk10, incertum, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/rules/blob/main/OWNERS)~~ [incertum,leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment