RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-16 11:04:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #117 from tstromberg/less-false2

Browse Source 
Speed up unexpected-bpf-users query by basing it on processes
This commit is contained in:
Thomas Strömberg 2023-01-09 15:19:08 -05:00 committed by GitHub
commit 81a6e99436
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
detection/discovery/unexpected-bpf-user.sql
View File

@ -23,14 +23,16 @@ SELECT
pp.euid AS parent_euid, pp.euid AS parent_euid,
hash.sha256 AS child_sha256, hash.sha256 AS child_sha256,
phash.sha256 AS parent_sha256 phash.sha256 AS parent_sha256
-- Using processes is much faster than process_memory_map
FROM FROM
process_memory_map pmm processes p
LEFT JOIN processes p ON pmm.pid = p.pid LEFT JOIN process_memory_map pmm ON p.pid = pmm.pid
LEFT JOIN processes pp ON p.parent = pp.pid LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN hash ON p.path = hash.path LEFT JOIN hash ON p.path = hash.path
LEFT JOIN hash AS phash ON pp.path = phash.path LEFT JOIN hash AS phash ON pp.path = phash.path
WHERE WHERE
( p.euid = 0
AND (
lib_path LIKE '%:bpf%' lib_path LIKE '%:bpf%'
OR lib_path LIKE '%libbpf%' OR lib_path LIKE '%libbpf%'
) )