RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-10 15:49:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

empty environ mac: fix typo in authority field name

Browse Source
This commit is contained in:
Thomas Stromberg 2022-11-01 07:20:57 -04:00
parent eb6851df7f
commit bd8bd02bd3
Failed to extract signature
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/evasion/empty_environ_macos.sql
View File

@ -44,7 +44,7 @@ WHERE -- This time should match the interval
signature.identifier LIKE 'com.apple.%' signature.identifier LIKE 'com.apple.%'
AND signature.authority = 'Software Signing' AND signature.authority = 'Software Signing'
) )
AND signature_authority NOT IN ( AND signature.authority NOT IN (
'Developer ID Application: Adobe Inc. (JQ525L2MZD)', 'Developer ID Application: Adobe Inc. (JQ525L2MZD)',
'Developer ID Application: Brave Software, Inc. (KL8N8XSYF4)', 'Developer ID Application: Brave Software, Inc. (KL8N8XSYF4)',
'Developer ID Application: Docker Inc (9BNSXJN65R)', 'Developer ID Application: Docker Inc (9BNSXJN65R)',