Merge pull request #176 from tstromberg/wutang

Add chattr, setenforce to unexpected-sysutils
2023-02-14 20:36:05 -05:00 · 2023-02-14 20:36:05 -05:00 · be02e9f785
parent 575ebdd776 5eefbd0dba
commit be02e9f785
1 changed files with 7 additions and 1 deletions
--- a/detection/execution/unexpected-sysutils-linux.sql
+++ b/detection/execution/unexpected-sysutils-linux.sql
@ -67,7 +67,13 @@ WHERE
  AND pe.path IN (
    '/usr/bin/sysctl',
    '/sbin/sysctl',
-    '/usr/sbin/sysctl'
+    '/usr/sbin/sysctl',
+    '/usr/bin/chattr',
+    '/sbin/chattr',
+    '/usr/sbin/chattr',
+    '/usr/bin/setenforce',
+    '/sbin/setenforce',
+    '/usr/sbin/setenforce'
  )
  AND p.parent > 0
 GROUP BY