2022-10-12 01:53:36 +00:00
|
|
|
-- Detect weird mounts, like mounting the EFI partition
|
2022-10-14 18:19:13 +00:00
|
|
|
--
|
|
|
|
|
-- references:
|
|
|
|
|
-- * https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/
|
|
|
|
|
--
|
|
|
|
|
-- platform: linux
|
|
|
|
|
-- tags: transient filesystem state
|
2022-10-12 01:53:36 +00:00
|
|
|
SELECT
|
|
|
|
|
*
|
|
|
|
|
FROM
|
|
|
|
|
mounts
|
|
|
|
|
WHERE
|
2022-10-13 18:59:32 +00:00
|
|
|
device = '/dev/disk0s1'
|
|
|
|
|
AND type = 'msdos';
|
