RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-17 01:47:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Filter out vaikas dev hostnames

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-13 17:58:29 -04:00
parent 20452b128b
commit 077c8f36fc
Failed to extract signature
4 changed files with 5862 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/impact/unexpected-etc-hosts.sql
View File

@ -21,6 +21,7 @@ WHERE
) )
AND hostnames NOT LIKE 'localhost.%' AND hostnames NOT LIKE 'localhost.%'
AND hostnames NOT LIKE '%.svc' AND hostnames NOT LIKE '%.svc'
AND hostnames NOT LIKE '%.%-%.%.dev'
AND hostnames NOT LIKE '%.test' AND hostnames NOT LIKE '%.test'
AND hostnames NOT LIKE '%.internal' AND hostnames NOT LIKE '%.internal'
AND hostnames NOT LIKE '%.local' AND hostnames NOT LIKE '%.local'

2
detection/persistence/unexpected-active-systemd-units.sql
View File

@ -1,5 +1,5 @@
SELECT SELECT
description AS "desc", description AS 'desc',
fragment_path AS path, fragment_path AS path,
hash.sha256, hash.sha256,
file.ctime, file.ctime,

4
detection/persistence/unexpected-chrome-extensions.sql
View File

@ -1,7 +1,7 @@
SELECT SELECT
name, name,
profile, profile,
chrome_extensions.description AS "descr", chrome_extensions.description AS 'descr',
persistent AS persists, persistent AS persists,
author, author,
chrome_extensions.path, chrome_extensions.path,
@ -9,7 +9,7 @@ SELECT
file.ctime, file.ctime,
from_webstore AS in_store, from_webstore AS in_store,
CAST(permissions AS text) AS perms, CAST(permissions AS text) AS perms,
state AS "enabled", state AS 'enabled',
CONCAT ( CONCAT (
from_webstore, from_webstore,
',', ',',

5858
{}.conf Normal file
View File

File diff suppressed because it is too large Load Diff