RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-17 18:07:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #395 from r0cketlad/16Oct2024

Browse Source 
refactoring alerts to reduce noise
This commit is contained in:
Thomas Strömberg 2024-10-16 15:01:44 -04:00 committed by GitHub
commit 0090392de3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
detection/evasion/unexpected-dev-entries.sql
View File

@ -47,10 +47,14 @@ WHERE
OR file.path LIKE '/dev/shm/jack_db%'
)
)
AND NOT (
file.size <= 32
AND file.path LIKE '/dev/shm/%'
)
AND file.path NOT LIKE '/dev/shm/lttng-ust-wait-%'
AND file.path NOT LIKE '/dev/shm/flatpak-%'
AND file.path NOT LIKE '/dev/shm/libpod_rootless_lock_%'
AND file.path NOT LIKE '/dev/shm/sem.mp-%'
AND file.path NOT LIKE '%/../%'
AND file.path NOT LIKE '%/./%'
AND file.path NOT IN ('/dev/.mdadm/', '/dev/shm/libpod_lock')
AND file.path NOT IN ('/dev/.mdadm/', '/dev/shm/libpod_lock', '/dev/shm/sem.camlock')

2
detection/execution/recently-created-executables-long-lived-linux.sql
View File

@ -3,7 +3,7 @@
-- false-positives:
-- * many
--
-- tags: transient process state
-- tags: transient process state extra
-- platform: linux
SELECT
f.ctime AS p0_ctime,

2
detection/execution/recently-created-executables-long-lived-macos.sql
View File

@ -3,7 +3,7 @@
-- false-positives:
-- * many
--
-- tags: transient process state
-- tags: transient process state extra
-- platform: darwin
SELECT
f.ctime,