Mark udev as 'extra' for now (disabled by default)

2024-09-23 11:19:16 -04:00 · 2024-09-23 11:19:16 -04:00 · c26be487b8
parent b85b9d550f
commit c26be487b8
1 changed files with 1 additions and 1 deletions
--- a/detection/persistence/suspicious-udev-runner-linux.sql
+++ b/detection/persistence/suspicious-udev-runner-linux.sql
@ -4,7 +4,7 @@
 --  * https://www.aon.com/en/insights/cyber-labs/unveiling-sedexp
 --  * https://ch4ik0.github.io/en/posts/leveraging-Linux-udev-for-persistence/
 --
-- tags: volume filesystem
+-- tags: volume filesystem extra
 -- platform: linux
 SELECT
  file.path,