RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-25 22:40:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #80 from tstromberg/more-flushing4

Browse Source 
etc-executables: Add redhat-lsb back
This commit is contained in:
Thomas Strömberg 2022-11-10 12:22:34 -05:00 committed by GitHub
commit aef8d98452
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
detection/evasion/unexpected-etc-executables.sql
View File

@ -31,13 +31,10 @@ WHERE
'/etc/acpi',
'/etc/alternatives',
'/etc/apcupsd',
'/etc/kde/shutdown',
'/etc/apm/resume.d',
'/etc/apm/scripts.d',
'/etc/nix/result',
'/etc/apm/suspend.d',
'/etc/avahi',
'/etc/nix/result/sw/bin',
'/etc/bash_completion.d',
'/etc/brltty/Contraction',
'/etc/chromium/native-messaging-hosts',
@ -69,6 +66,7 @@ WHERE
'/etc/ifplugd',
'/etc/ifplugd/action.d',
'/etc/init.d',
'/etc/kde/shutdown',
'/etc/kernel/header_postinst.d',
'/etc/kernel/install.d',
'/etc/kernel/postinst.d',
@ -83,6 +81,8 @@ WHERE
'/etc/network/if-pre-up.d',
'/etc/network/if-up.d',
'/etc/NetworkManager/dispatcher.d',
'/etc/nix/result',
'/etc/nix/result/sw/bin',
'/etc/openvpn',
'/etc/periodic/daily',
'/etc/periodic/monthly',
@ -112,6 +112,7 @@ WHERE
'/etc/rc.d/rc6.d',
'/etc/rcS.d',
'/etc/rdnssd',
'/etc/redhat-lsb',
'/etc/security',
'/etc/skel',
'/etc/ssl/certs',