RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make all of ~/.% an exclusion

This commit is contained in:
Thomas Stromberg 2022-11-08 14:22:12 -05:00
parent 3dec23370c
commit 748be4c251
Failed to extract signature
1 changed files with 1 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
detection/evasion/hidden-cwd.sql
View File

@ -100,29 +100,16 @@ WHERE
'gitsign',
'Code Helper'
)
OR dir LIKE '~/.cache/yay/%'
OR dir LIKE '~/.cargo/%'
OR dir LIKE '~/.%'
OR dir LIKE '~/code/%'
OR dir LIKE '~/.dotfiles/%'
OR dir LIKE '~/%/.git'
OR dir LIKE '~/.gimme%'
OR dir LIKE '~/%/.github%'
OR dir LIKE '~/%/src/%'
OR dir LIKE '~/%/.modcache/%'
OR dir LIKE '~/.gradle/%'
OR dir LIKE '~/%/github.com/%'
OR dir LIKE '/Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/%'
OR dir LIKE '~/.local/share/fish/%'
OR dir LIKE '~/.local/share/JetBrains/%'
OR dir LIKE '~/.local/share/kotlin/%'
OR dir LIKE '~/.local/share/nvim/%'
OR dir LIKE '~/.local/share/Steam/%'
OR dir LIKE '~/.provisio%'
OR dir LIKE '~/src/%'
OR dir LIKE '~/%/.terraform%'
OR dir LIKE '~/.vim%'
OR dir LIKE '~/.vscode/extensions/%'
OR dir LIKE '~/.zsh/%'
OR dir LIKE '/tmp/.mount_%'
-- For sudo calls to other things
OR (