RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-03-08 03:37:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add ~/.config/.* to search criteria

Browse Source
This commit is contained in:
Thomas Stromberg 2023-06-07 15:15:02 -04:00
parent cd8ec86341
commit 7a61b5eced
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
detection/evasion/hidden-home-config-dir.sql
View File

@ -24,7 +24,8 @@ FROM
LEFT JOIN magic ON file.path = magic.path
WHERE
(
file.path LIKE '/home/%/.config/%%/.%/%'
file.path LIKE "/home/%/.config/.%"
OR file.path LIKE '/home/%/.config/%%/.%/%'
OR file.path LIKE '/home/%/.config/.%/%'
OR file.path LIKE '/home/%/.config/%%/.%/.%'
OR file.path LIKE '/root/.config/%%/.%/%'
@ -36,3 +37,4 @@ WHERE
AND file.path NOT LIKE '%/./%'
AND file.path NOT LIKE '/root/.debug/.build-id/%'
AND file.path NOT LIKE '/home/%/.config/%/.git%'
AND file.path NOT LIKE '/home/%/.config/.gsd-keyboard.settings-ported'