RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-07 13:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add more /Library entries from the wild

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-20 13:38:33 -04:00
parent 0a92cbb9ce
commit 44324e3811
Failed to extract signature
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
detection/evasion/unexpected-library-entries-macos.sql
View File

@ -39,6 +39,7 @@ WHERE
'/Library/Application Support/',
'/Library/Audio/',
'/Library/AutoBugCapture/',
'/Library/Automator/',
'/Library/Bluetooth/',
'/Library/Caches/',
'/Library/Catacomb/',
@ -57,6 +58,7 @@ WHERE
'/Library/DirectoryServices/',
'/Library/Documentation/',
'/Library/DriverExtensions/',
'/Library/DropboxHelperTools/',
'/Library/Extensions/',
'/Library/Filesystems/',
'/Library/Fonts/',
@ -87,7 +89,10 @@ WHERE
'/Library/Objective-See/',
'/Library/OpenDirectory/',
'/Library/OSAnalytics/',
'/Library/OSAnalytics/.DS_Store',
'/Library/PDF Services/',
'/Library/Perl/',
'/Library/Plug-Ins/',
'/Library/PreferencePanes/',
'/Library/Preferences/',
'/Library/Preferences/.GlobalPreferences.plist',