Remove Python whitelist, see pymafka

2023-01-13 13:47:19 -05:00 · 2023-01-13 13:47:19 -05:00 · c045daa8f9
parent dd3149a34b
commit c045daa8f9
1 changed files with 1 additions and 1 deletions
--- a/detection/initial_access/unexpected-shell-parent-events.sql
+++ b/detection/initial_access/unexpected-shell-parent-events.sql
@ -99,8 +99,8 @@ WHERE
      'nvim',
      'package_script_service',
      'perl',
+      -- 'python' - do not include this, or you won't detect supply-chain attacks.
      'PK-Backend',
-      'python',
      'roxterm',
      'sdk',
      'sdzoomplugin',