RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-10 07:39:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add exceptions for xcode-select, yum, nix-daemon

Browse Source
This commit is contained in:
Thomas Stromberg 2022-09-26 18:13:48 -04:00
parent 997c441b79
commit b50f06bdfe
Failed to extract signature
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
process/unexpected-shell-parents.sql
View File

@ -37,6 +37,7 @@ WHERE
'kubectl',
'make',
'monorail',
'nix-daemon',
'nix',
'node',
'nvim',
@ -59,6 +60,7 @@ WHERE
'xargs',
'xcrun',
'xfce4-terminal',
'yum',
'zsh'
)
AND parent_path NOT IN (
@ -84,7 +86,8 @@ WHERE
)
-- npm run server
AND NOT p.cmdline IN (
'sh -c -- exec-bin node_modules/.bin/hugo/hugo server'
'sh -c -- exec-bin node_modules/.bin/hugo/hugo server',
'sh -c xcode-select --print-path >/dev/null 2>&1 && xcrun --sdk macosx --show-sdk-path 2>/dev/null'
)
AND NOT (
pp.name = 'sshd'