RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-07 13:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow -sP /usr/sbin/firewalld

Browse Source
This commit is contained in:
Thomas Stromberg 2022-11-16 11:03:34 -05:00
parent 8047c88374
commit b8d66ae814
Failed to extract signature
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
detection/discovery/unexpected-pcap-user-linux.sql
View File

@ -46,9 +46,8 @@ WHERE
)
AND child_cmd NOT IN (
'/nix/var/nix/profiles/default/bin/nix-daemon',
'/run/current-system/systemd/lib/systemd/systemd',
'/usr/bin/python3 -s /usr/sbin/firewalld',
'/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid'
'/run/current-system/systemd/lib/systemd/systemd'
)
AND child_cmd NOT LIKE '/usr/bin/python3 -s%/usr/sbin/firewalld%'
GROUP BY
pmm.pid