RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #365 from tstromberg/fpr-apr25 

mark command-events & execdir-events as 'extra' due to high CPU usage
This commit is contained in:
Thomas Strömberg 2024-04-29 09:33:44 -04:00 committed by GitHub
parent 6dd798c4a0 03ea3bcff2
commit a0c49efb3f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/execution/exotic-command-events-macos.sql
View File

@ -6,7 +6,7 @@
-- false positives: -- false positives:
-- * possible, but none known -- * possible, but none known
-- --
-- tags: transient process events -- tags: transient process events extra
-- platform: darwin -- platform: darwin
-- interval: 180 -- interval: 180
SELECT -- Child SELECT -- Child

2
detection/execution/unexpected-execdir-events-macos.sql
View File

@ -9,7 +9,7 @@
-- --
-- interval: 240 -- interval: 240
-- platform: darwin -- platform: darwin
-- tags: filesystem events -- tags: filesystem events extra
SELECT SELECT
COALESCE( COALESCE(
REGEX_MATCH (REPLACE(pe.path, u.directory, '~'), '(.*)/', 1), REGEX_MATCH (REPLACE(pe.path, u.directory, '~'), '(.*)/', 1),