RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add pavucontrol and snapd

This commit is contained in:
Thomas Stromberg 2022-11-03 16:05:07 -04:00
parent e650ab6abc
commit 2dfc3860ef
Failed to extract signature
1 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
detection/execution/recently-created-executables-linux.sql
View File

@ -45,41 +45,43 @@ WHERE
'/opt/google/chrome/chrome',
'/opt/google/chrome/chrome_crashpad_handler',
'/opt/google/chrome/nacl_helper',
'/usr/bin/containerd',
'/usr/bin/dockerd',
'/usr/bin/bash',
'/usr/bin/gedit',
'/usr/bin/obs',
'/usr/bin/docker-proxy',
'/usr/lib/google-cloud-sdk/platform/bundledpythonunix/bin/python3',
'/usr/lib/snapd/snapd',
'/usr/bin/pipewire',
'/usr/bin/tailscaled',
'/usr/bin/rpi-imager',
'/usr/bin/udevadm',
'/usr/bin/cargo',
'/usr/bin/containerd',
'/usr/bin/containerd-shim-runc-v2',
'/usr/bin/dockerd',
'/usr/bin/docker-proxy',
'/usr/bin/gedit',
'/usr/bin/gnome-keyring-daemon',
'/usr/bin/obs',
'/usr/bin/pavucontrol'
'/usr/bin/pipewire',
'/usr/bin/rpi-imager',
'/usr/bin/tailscaled',
'/usr/bin/udevadm',
'/usr/lib/at-spi2-registryd',
'/usr/lib/at-spi-bus-launcher',
'/usr/libexec/docker/docker-proxy',
'/usr/libexec/fwupd/fwupd',
'/usr/libexec/snapd/snapd',
'/usr/libexec/sssd/sssd_kcm',
'/usr/bin/gnome-keyring-daemon',
'/usr/lib/fwupd/fwupd',
'/usr/lib/gdm',
'/usr/lib/gdm-session-worker',
'/usr/lib/gdm-x-session',
'/usr/lib/google-cloud-sdk/platform/bundledpythonunix/bin/python3',
'/usr/lib/polkit-1/polkitd',
'/usr/lib/slack/chrome_crashpad_handler',
'/usr/lib/slack/slack',
'/usr/lib/snapd/snapd',
'/usr/lib/systemd/systemd',
'/usr/lib/systemd/systemd-journald',
'/usr/lib/systemd/systemd-logind',
'/usr/lib/polkit-1/polkitd',
'/usr/lib/systemd/systemd-oomd',
'/usr/lib/systemd/systemd-resolved',
'/usr/lib/systemd/systemd-timesyncd',
'/usr/lib/x86_64-linux-gnu/obs-plugins/obs-browser-page',
'/usr/lib/xf86-video-intel-backlight-helper',
'/usr/bin/containerd-shim-runc-v2',
'/usr/sbin/chronyd',
'/usr/sbin/cupsd',
'/usr/sbin/tailscaled'