Merge pull request #241 from tstromberg/fpr-apr14

systemd: Filter out targets, add more entries
2024-12-14 18:14:34 +00:00 · 2023-04-27 11:59:33 -04:00 · 2023-04-27 11:59:33 -04:00 · 8017adf36a
commit 8017adf36a
parent 27caaecb3d ed772cb369
1 changed files with 1 additions and 0 deletions
--- a/detection/persistence/unexpected-systemctl-calls-linux.sql
+++ b/detection/persistence/unexpected-systemctl-calls-linux.sql
@ -71,6 +71,7 @@ WHERE
  AND NOT exception_key IN (
    'systemctl,0,apt-helper,',
    'systemctl,0,,containerd-shim-runc-v2',
+    'systemctl,0,kubeadm,containerd-shim-runc-v2',
    'systemctl,0,dash,logrotate',
    'systemctl,0,pacman,pacman',
    'systemctl,500,zsh,tmux',