RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into feb16-fpr

This commit is contained in:
Thomas Stromberg 2024-02-23 16:25:24 -05:00
parent 5507ae1458 d1f6aede22
commit a266879668
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
detection/evasion/unusually-tainted-kernel-linux.sql
View File

@ -37,10 +37,11 @@ FROM
ORDER BY ORDER BY
km.name ASC km.name ASC
) )
-- 4096 is a signed, out of tree, open source driver
-- 4097 is a signed, out of tree, proprietary driver -- 4097 is a signed, out of tree, proprietary driver
-- 512 is a kernel warning -- 512 is a kernel warning
WHERE WHERE
taint NOT IN (0, 512, 4097) taint NOT IN (0, 512, 4096, 4097)
AND NOT ( AND NOT (
( (
-- 12289 is an unsigned, out of tree, proprietary -- 12289 is an unsigned, out of tree, proprietary