Remove sshd listener false positive

2022-10-13 18:02:14 -04:00 · 2022-10-13 18:02:14 -04:00 · 3562bc898e
parent 59dc85a931
commit 3562bc898e
1 changed files with 3 additions and 1 deletions
--- a/detection/evasion/ssh-notty.sql
+++ b/detection/evasion/ssh-notty.sql
@ -8,4 +8,6 @@ SELECT * FROM (
 )
 WHERE INSTR(cmdline, '@notty') > 0
 OR
-INSTR(open_files, '/dev/ptmx') = 0;
+(
+    open_files != "/dev/null" AND INSTR(open_files, '/dev/ptmx') = 0
+)