osquery-defense-kit/detection/persistence/unexpected-cron-entries.sql

13 lines
308 B
MySQL
Raw Normal View History

SELECT
*
FROM
crontab
WHERE
command NOT LIKE "root%run-parts%"
AND command NOT LIKE "%freshclam%"
AND command NOT LIKE "%clamscan%"
AND command NOT LIKE "%e2scrub%"
AND command NOT LIKE "%zfs-linux%"
AND command NOT LIKE "%anacron start%"
AND command NOT LIKE "%/usr/lib/php/sessionclean%"