RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-06 20:51:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #361 from tstromberg/kandji

Browse Source 
Allow Kandji to do weird things with expect
This commit is contained in:
Thomas Strömberg 2024-03-15 15:35:44 -04:00 committed by GitHub
commit 6eb5b9ebdb
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/initial_access/unexpected-shell-parent-events.sql
View File

@ -248,6 +248,7 @@ WHERE
)
OR exception_key IN (
'bash,0,auditd,launchd',
'sh,0,expect,kandji-daemon',
'bash,0,etcd,containerd-shim-runc-v2',
'bash,0,kube-apiserver,containerd-shim-runc-v2',
'bash,0,mutter-x11-frames,gnome-shell',