RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add detectors for unexpected executables in strange places

This commit is contained in:
Thomas Stromberg 2022-09-29 11:38:14 -04:00
parent 5b7858e3cf
commit 49f2d5a579
Failed to extract signature
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/unexpected-tmp-executables.sql
View File

@ -70,3 +70,5 @@ WHERE
AND NOT file.directory LIKE "/tmp/msu-target-%" AND NOT file.directory LIKE "/tmp/msu-target-%"
-- I don't know man. I don't work here. -- I don't know man. I don't work here.
AND NOT (file.path LIKE ("/tmp/%compressed") AND size < 4000 AND uid>500) AND NOT (file.path LIKE ("/tmp/%compressed") AND size < 4000 AND uid>500)
-- Executables too small to even hold "#!/bin/sh\nuid"
AND NOT (file.type = "regular" AND size < 10)