Show process euid instead of uid.

2022-10-14 09:36:28 -04:00 · 2022-10-14 09:36:28 -04:00 · 488d1aac96
parent b2f0c1ca54
commit 488d1aac96
2 changed files with 3 additions and 2 deletions
--- a/detection/evasion/missing-from-disk-linux.sql
+++ b/detection/evasion/missing-from-disk-linux.sql
@ -1,9 +1,10 @@
 -- Processes that do not exist on disk
 --
 -- tags: periodic daemon
+-- platform: linux
 SELECT
  p.pid,
-  p.uid,
+  p.euid,
  p.cmdline,
  p.path,
  mnt_namespace,
--- a/detection/evasion/parent-missing-from-disk.sql
+++ b/detection/evasion/parent-missing-from-disk.sql
@ -8,7 +8,7 @@ SELECT
  p.pid AS child_pid,
  p.path AS child_path,
  p.cmdline AS child_cmd,
-  p.uid AS child_uid,
+  p.euid AS child_euid,
  p.gid AS child_gid,
  hash.path,
  p.on_disk AS child_on_disk,