RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-13 09:34:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add exceptions for /Library/Python and /Library/Caches/.0%

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-20 13:14:37 -04:00
parent a973dcbcf2
commit 8e1569164a
Failed to extract signature
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
detection/evasion/unexpected-library-entries-macos.sql
View File

@ -93,6 +93,7 @@ WHERE
'/Library/Preferences/.GlobalPreferences.plist', '/Library/Preferences/.GlobalPreferences.plist',
'/Library/Printers/', '/Library/Printers/',
'/Library/PrivilegedHelperTools/', '/Library/PrivilegedHelperTools/',
'/Library/Python/',
'/Library/QuickLook/', '/Library/QuickLook/',
'/Library/Receipts/', '/Library/Receipts/',
'/Library/Ruby/', '/Library/Ruby/',
@ -122,4 +123,4 @@ WHERE
'/Library/WebServer/Documents/index.html.en', '/Library/WebServer/Documents/index.html.en',
'/Library/WebServer/share/' '/Library/WebServer/share/'
) )
AND NOT file.path LIKE '/Library/Caches/.00%' AND NOT file.path LIKE '/Library/Caches/.0%'