10 lines
273 B
MySQL
10 lines
273 B
MySQL
|
-- Inspired by BPFdoor
|
||
|
|
-- https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
|
||
|
|
SELECT COUNT(*) AS count,
|
||
|
|
p.pid,
|
||
|
|
p.path,
|
||
|
|
p.cmdline
|
||
|
|
FROM process_envs pe
|
||
|
|
JOIN processes p ON pe.pid = p.pid
|
||
|
|
GROUP BY p.pid
|
||
|
|
HAVING count == 0;
|