osquery-defense-kit/incident_response/authorized_keys.sql

6 lines
204 B
MySQL
Raw Normal View History

2023-02-23 14:35:38 +00:00
-- Retrieves all the currently installed authorized keys on a system
--
-- tags: postmortem
-- platform: posix
SELECT authorized_keys.* FROM users JOIN authorized_keys ON users.uid = authorized_keys.uid;