RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-03 03:01:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Include more commands

Browse Source
This commit is contained in:
Thomas Stromberg 2023-01-13 13:49:41 -05:00
parent 4ec1581cc3
commit 41e68657e9
Failed to extract signature
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
detection/execution/exotic-commands.sql
View File

@ -66,11 +66,14 @@ WHERE
OR cmd LIKE '%iptables -P % ACCEPT%'
OR cmd LIKE '%iptables -F%'
OR cmd LIKE '%chattr -ia%'
OR cmd LIKE '%chflags uchg%'
OR cmd LIKE '%chmod 777 %'
OR cmd LIKE '%bpftool%'
OR cmd LIKE '%touch%acmr%'
OR cmd LIKE '%ld.so.preload%'
OR cmd LIKE '%urllib.urlopen%'
OR cmd LIKE '%launchctl list%'
OR cmd LIKE '%launchctl load%'
OR cmd LIKE '%nohup%tmp%'
OR cmd LIKE '%set visible of front window to false%'
OR cmd LIKE '%chrome%--load-extension%'
@ -108,3 +111,5 @@ WHERE
OR cmd LIKE '%socat%'
OR cmd LIKE '%SOCK_STREAM%'
OR INSTR(cmd, '%Socket.%') > 0
-- Keep the shell running, as in https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
OR cmd LIKE '%tail -f /dev/null%'