RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #411 from chainguard-dev/r0cketlad-patch-1 

add extra tag to  high_disk_bytes_read.sql
This commit is contained in:
Dave Smith 2024-10-25 16:36:47 -04:00 committed by GitHub
parent 7fad85ceeb 0c10622a50
commit 98d214e2ad
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/exfil/high_disk_bytes_read.sql
View File

@ -10,7 +10,7 @@
-- references:
-- * https://attack.mitre.org/tactics/TA0010/ (Exfiltration)
--
-- tags: transient process
-- tags: transient process extra
SELECT
-- WARNING: Writes to tmpfs are not reflected against this counter
p0.disk_bytes_read AS bytes_read,