revert euid change in exception key

2023-03-16 17:31:31 -04:00 · 2023-03-16 17:31:31 -04:00 · 6473469e72
parent fbc2b207b4
commit 6473469e72
1 changed files with 2 additions and 1 deletions
--- a/detection/persistence/unexpected-uid0-daemon-linux.sql
+++ b/detection/persistence/unexpected-uid0-daemon-linux.sql
@ -22,7 +22,8 @@ SELECT
      "__VERSION__"
    ),
    ',',
-    p0.euid,
+    -- This is intentionally not euid, as everything is euid 0
+    p0.uid,
    ',',
    CONCAT (
      SPLIT (p0.cgroup_path, "/", 0),