RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-05 21:09:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add broader port exception for Chrome

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-20 14:11:19 -04:00
parent 44324e3811
commit 416bdd8fd1
Failed to extract signature
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
detection/c2/unexpected-talkers-linux.sql
View File

@ -106,5 +106,12 @@ WHERE
AND s.protocol = 6
AND p.euid > 500
)
AND NOT (
p.name = 'chrome'
AND f.filename = 'chrome'
AND s.remote_port > 5000
AND s.protocol = 6
AND p.euid > 500
)
GROUP BY
p.cmdline