osquery-defense-kit/incident_response/mounts.sql

9 lines
252 B
MySQL
Raw Normal View History

2022-10-13 13:11:17 +00:00
-- Retrieves the current list of mounted drives in the target system.
--
-- interval: 3600
-- platform: posix
-- value: Scope for lateral movement. Potential exfiltration locations. Potential dormant backdoors.
-- version: 1.4.5
select * from mounts;