Merge pull request #44 from tstromberg/exotic-rm

exotic cmdline macos: Exclude locatedb updates
2022-10-29 12:12:20 -04:00 · 2022-10-29 12:12:20 -04:00 · 62b4e2bd9b
parent 0c0a38df44 81b97536e9
commit 62b4e2bd9b
1 changed files with 2 additions and 0 deletions
--- a/detection/execution/exotic-command-events-macos.sql
+++ b/detection/execution/exotic-command-events-macos.sql
@ -117,4 +117,6 @@ WHERE
    AND p.parent = -1
  )
  AND NOT cmd LIKE '/bin/rm -f /tmp/periodic.%'
+  AND NOT cmd LIKE 'rm -f /tmp/locate%/_updatedb%'
+  AND NOT cmd LIKE 'rm -f /tmp/locate%/mklocate%/_mklocatedb%'
  AND NOT cmd LIKE 'touch -r /tmp/KSInstallAction.%'