RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix start-iap-tunnel matching

This commit is contained in:
Thomas Stromberg 2023-02-02 20:55:46 -05:00
parent 2bdb9f2f3e
commit 9ea6486121
Failed to extract signature
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/initial_access/unexpected-shell-parent-events.sql
View File

@ -208,7 +208,7 @@ WHERE
) )
OR ( OR (
p1_name = 'ssh' p1_name = 'ssh'
AND p0_cmd LIKE 'gcloud.py compute start-iap-tunnel%' AND p0_cmd LIKE '%gcloud.py compute start-iap-tunnel%'
) )
OR exception_key IN ( OR exception_key IN (
'bash,0,pia-daemon,launchd', 'bash,0,pia-daemon,launchd',