RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #400 from r0cketlad/21oct2024 

small fpr push
This commit is contained in:
Thomas Strömberg 2024-10-23 11:40:41 -04:00 committed by GitHub
parent 5c7bdbc31f fbf9a565c6
commit c8e99a5ee1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
detection/execution/unexpected-setuid-binaries.sql
View File

@ -119,7 +119,9 @@ FROM
'/usr/sbin/umount.nfs', '/usr/sbin/umount.nfs',
'/usr/sbin/umount.nfs4', '/usr/sbin/umount.nfs4',
'/usr/sbin/userhelper', '/usr/sbin/userhelper',
'/usr/sbin/wodim' '/usr/sbin/wodim',
'/bin/bwrap',
'/usr/bin/bwrap'
) )
) )
AND NOT ( AND NOT (

3
detection/impact/evenly-timestomped.sql
View File

@ -26,7 +26,6 @@ WHERE
OR file.path LIKE "/etc/%%" OR file.path LIKE "/etc/%%"
OR file.path LIKE "/sbin/%%" OR file.path LIKE "/sbin/%%"
OR file.path LIKE "/lib/%%" OR file.path LIKE "/lib/%%"
OR file.path LIKE "/usr/%%"
) )
-- This timestamp is in UTC -- This timestamp is in UTC
AND file.mtime > (strftime('%s', 'now') - (86400 * 720)) AND file.mtime > (strftime('%s', 'now') - (86400 * 720))
@ -51,5 +50,3 @@ WHERE
AND file.path NOT LIKE '%/lynis%' AND file.path NOT LIKE '%/lynis%'
AND file.path NOT LIKE '%/yelp-xsl%' AND file.path NOT LIKE '%/yelp-xsl%'
AND file.path NOT LIKE '/etc/cups/%' AND file.path NOT LIKE '/etc/cups/%'
AND file.path NOT LIKE '/usr/share/libinput/%.quirks'
AND file.path NOT LIKE '/usr/lib64/electron/locales/%.pak'