RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-09 05:56:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Speed up unexpected-bpf-users query by basing it on processes

Browse Source
This commit is contained in:
Thomas Stromberg 2023-01-09 15:18:00 -05:00
parent 420d269025
commit 4000bac9f9
Failed to extract signature
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
detection/discovery/unexpected-bpf-user.sql
View File

@ -23,14 +23,16 @@ SELECT
pp.euid AS parent_euid,
hash.sha256 AS child_sha256,
phash.sha256 AS parent_sha256
-- Using processes is much faster than process_memory_map
FROM
process_memory_map pmm
LEFT JOIN processes p ON pmm.pid = p.pid
processes p
LEFT JOIN process_memory_map pmm ON p.pid = pmm.pid
LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN hash ON p.path = hash.path
LEFT JOIN hash AS phash ON pp.path = phash.path
WHERE
(
p.euid = 0
AND (
lib_path LIKE '%:bpf%'
OR lib_path LIKE '%libbpf%'
)