RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-03-02 08:50:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Include osacompile

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-29 11:43:58 -04:00
parent 3ac2f07708
commit 1c2d605bb0
Failed to extract signature
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
detection/execution/unexpected-osascript-calls.sql
View File

@ -45,7 +45,7 @@ FROM
LEFT JOIN signature ON pp.path = signature.path
LEFT JOIN signature esignature ON ppe.path = esignature.path
WHERE
p.path = '/usr/bin/osascript'
p.path IN ('/usr/bin/osascript', '/usr/bin/osacompile')
AND p.time > (strftime('%s', 'now') -60)
AND exception_key NOT IN (
',,osascript',
@ -65,5 +65,6 @@ WHERE
)
AND NOT cmd LIKE 'osascript -e set zoomStatus to "closed"%'
AND NOT cmd LIKE 'osascript openChrome.applescript http://127.0.0.1:%'
AND NOT cmd LIKE '/usr/bin/osascript /Users/%/osx-trash/trashfile.AppleScript %'
GROUP BY
p.pid