Merge pull request #195 from tstromberg/rootkit-detection

incident response: Add dump of /dev files
2023-02-23 17:11:10 -05:00 · 2023-02-23 17:11:10 -05:00 · 6eff54d7f3
parent c198de4133 c8ecc36079
commit 6eff54d7f3
1 changed files with 8 additions and 0 deletions
--- a/incident_response/files-dev.sql
+++ b/incident_response/files-dev.sql
@ -0,0 +1,8 @@
+-- Returns a list of file information from /dev (non-hidden only)
+--
+-- tags: postmortem
+-- platform: posix
+SELECT *
+FROM file
+    JOIN hash ON file.path = hash.path
+WHERE file.path LIKE "/dev/%%";