osquery-defense-kit/process/hidden-parent-pid.sql

6 lines
237 B
MySQL
Raw Normal View History

2022-09-11 19:07:54 +00:00
-- Works well for revealing boopkit, so long as boopkit has a child process.
SELECT pp.* FROM processes
JOIN processes pp ON processes.parent = pp.pid
WHERE processes.parent NOT IN (SELECT pid FROM processes) AND processes.parent != 0;