mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-02-17 01:47:06 +00:00
10 lines
241 B
MySQL
10 lines
241 B
MySQL
|
-- Detect weird mounts, like mounting the EFI partition
|
||
|
|
-- See https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/
|
||
|
|
SELECT
|
||
|
|
*
|
||
|
|
FROM
|
||
|
|
mounts
|
||
|
|
WHERE
|
||
|
|
device = "/dev/disk0s1"
|
||
|
|
AND type = "msdos";
|