RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-20 03:36:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable suspicious systemd, disable unexpected-active

Browse Source
This commit is contained in:
Thomas Stromberg 2024-10-11 10:00:37 -04:00
parent c60c8ccf39
commit a3fcee2ad3
Failed to extract signature
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
detection/persistence/suspicious-systemd-unit.sql
View File

@ -8,7 +8,7 @@
-- false positives:
-- * home-made systemd files
--
-- tags: persistent filesystem systemd extra
-- tags: persistent filesystem systemd
-- platform: linux
SELECT
file.path,
@ -117,6 +117,7 @@ rule systemd_small_multiuser_no_comments_or_documentation : high {
$not_dbus = "Type=dbus"
$not_oneshot = "Type=oneshot"
$not_lima = "Description=lima-guestagent"
$not_bluefin = "projectbluefin.io"
condition:
filesize < 384 and $execstart and $multiuser and none of ($not_*)
}

2
detection/persistence/unexpected-active-systemd-units.sql
View File

@ -6,7 +6,7 @@
-- false positives:
-- * System updates
--
-- tags: persistent seldom filesystem systemd
-- tags: persistent seldom filesystem systemd extra
-- platform: linux
SELECT -- description AS 'desc',
fragment_path,