mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-02-07 21:21:33 +00:00
6 lines
237 B
MySQL
6 lines
237 B
MySQL
|
-- Works well for revealing boopkit, so long as boopkit has a child process.
|
||
|
|
SELECT pp.* FROM processes
|
||
|
|
JOIN processes pp ON processes.parent = pp.pid
|
||
|
|
WHERE processes.parent NOT IN (SELECT pid FROM processes) AND processes.parent != 0;
|
||
|
|
|