Also include binaries running from a hidden directory (1 deep)

2023-01-13 13:48:47 -05:00 · 2023-01-13 13:48:47 -05:00 · 4ec1581cc3
parent 00872b28bb
commit 4ec1581cc3
1 changed files with 1 additions and 0 deletions
--- a/detection/evasion/hidden-executable.sql
+++ b/detection/evasion/hidden-executable.sql
@ -29,6 +29,7 @@ WHERE
  (
    p.name LIKE '.%'
    OR f.filename LIKE '.%'
+    OR f.directory LIKE '.%'
  )
  AND NOT f.path LIKE '/nix/store/%/%-wrapped'
  AND NOT (