RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-27 23:40:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #277 from tstromberg/hidden-provisio

Browse Source 
hidden executable: Add provisio exception
This commit is contained in:
Thomas Strömberg 2023-06-09 07:14:16 -04:00 committed by GitHub
commit b8d3eee979
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/evasion/hidden-executable.sql
View File

@ -48,6 +48,7 @@ WHERE
AND NOT f.directory LIKE '%/.bin-unwrapped'
AND NOT f.directory LIKE '%/.cargo/bin'
AND NOT f.directory LIKE '%/.config/nvm/%/bin'
AND NOT f.directory LIKE '%/.provisio/bin/%'
AND NOT f.directory LIKE '%/.local/%'
AND NOT f.directory LIKE '%/node_modules/.bin/%'
AND NOT f.directory LIKE '%/.nvm/versions/%/bin'