2023-01-26 16:40:54 +00:00
|
|
|
-- Notices volumes with unusual names
|
|
|
|
|
--
|
|
|
|
|
-- references:
|
|
|
|
|
-- * https://objective-see.org/blog/blog_0x4E.html (Shlayer)
|
|
|
|
|
--
|
|
|
|
|
-- tags: transient volume filesystem often
|
|
|
|
|
-- platform: darwin
|
|
|
|
|
SELECT mounts.path,
|
|
|
|
|
mounts.device,
|
|
|
|
|
mounts.type,
|
|
|
|
|
REGEX_MATCH (mounts.path, '.*/(.*)', 1) AS vol_name,
|
|
|
|
|
block_devices.vendor,
|
|
|
|
|
block_devices.model,
|
|
|
|
|
block_devices.uuid
|
|
|
|
|
FROM mounts
|
|
|
|
|
LEFT JOIN block_devices ON mounts.device = block_devices.name
|
|
|
|
|
WHERE block_devices.type NOT IN ('Apple Fabric', 'PCI-Express')
|
|
|
|
|
AND vol_name NOT LIKE '%backup%'
|
|
|
|
|
AND vol_name NOT IN (
|
|
|
|
|
'Slack',
|
|
|
|
|
'Docker',
|
2023-01-26 21:30:14 +00:00
|
|
|
'Figma Agent Installer',
|
2023-01-26 16:40:54 +00:00
|
|
|
'WhatsApp Installer',
|
2023-01-26 21:30:14 +00:00
|
|
|
'Snagit',
|
2023-01-26 16:40:54 +00:00
|
|
|
'Bartender 4'
|
|
|
|
|
)
|
|
|
|
|
AND vol_name NOT LIKE 'Signal %-universal'
|
2023-01-27 01:40:47 +00:00
|
|
|
AND vol_name NOT LIKE 'Gephi %'
|
|
|
|
|
AND mounts.path NOT LIKE '/private/tmp/KSInstallAction.%'
|
