RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-01 02:01:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore taint code 4096 (out-of-tree driver)

Browse Source
This commit is contained in:
Thomas Stromberg 2024-02-22 11:48:53 -05:00
parent 9b66ef1d29
commit af07ef9888
Failed to extract signature
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
detection/evasion/unusually-tainted-kernel-linux.sql
View File

@ -37,10 +37,11 @@ FROM
ORDER BY
km.name ASC
)
-- 4096 is a signed, out of tree, open source driver
-- 4097 is a signed, out of tree, proprietary driver
-- 512 is a kernel warning
WHERE
taint NOT IN (0, 512, 4097)
taint NOT IN (0, 512, 4096, 4097)
AND NOT (
(
-- 12289 is an unsigned, out of tree, proprietary