RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-14 10:04:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #227 from tstromberg/more-exotic

Browse Source 
chmod events: broaden snap .config exception
This commit is contained in:
Thomas Strömberg 2023-03-17 10:54:26 -04:00 committed by GitHub
commit 6c9759b003
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/execution/unexpected-chmod-exec-event.sql
View File

@ -85,7 +85,7 @@ WHERE
)
AND cmdline NOT LIKE 'chmod 777 /app/%'
AND cmdline NOT LIKE 'chmod 700 /tmp/apt-key-gpghome.%'
AND cmdline NOT LIKE 'chmod 700 /home/%/snap/firefox/%/.config'
AND cmdline NOT LIKE 'chmod 700 /home/%/snap/%/%/.config'
AND cmdline != 'chmod 0777 /Users/Shared/logitune'
)
AND f.type != 'directory'