RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-18 19:40:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #181 from tstromberg/friday-sweep

Browse Source 
execdir events macOS: Fix ambiguous path
This commit is contained in:
Thomas Strömberg 2023-02-17 12:01:38 -05:00 committed by GitHub
commit a4ad9b2aaa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/execution/unexpected-execdir-events-macos.sql
View File

@ -193,7 +193,7 @@ WHERE
AND p.cmdline LIKE './%'
)
-- Spotify
AND path NOT LIKE '/private/var/folders/%/T/sp_relauncher'
AND pe.path NOT LIKE '/private/var/folders/%/T/sp_relauncher'
AND dir NOT LIKE '/Applications/%'
AND dir NOT LIKE '~/%/bin'
AND dir NOT LIKE '~/%/google-cloud-sdk/bin/%'