RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use correct column name

This commit is contained in:
Thomas Stromberg 2023-09-20 08:07:57 -04:00
parent 4e820ae59e
commit d0e73093ae
Failed to extract signature
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
detection/execution/exotic-command-events-linux.sql
View File

@ -120,13 +120,13 @@ WHERE
OR p0_cmd LIKE '%ld.so.preload%'
OR p0_cmd LIKE '%urllib.urlopen%'
OR p0_cmd LIKE '%nohup%tmp%'
OR p0.cmdline LIKE '%.ssh/%'
OR p0.cmdline LIKE '%tar%.local/share%'
OR p0.cmdline LIKE '%.config%gcloud%'
OR p0.cmdline LIKE '%.aws/%'
OR p0.cmdline LIKE '%.mozilla%firefox%'
OR p0.cmdline LIKE '%.config/%chrome%'
OR p0.cmdline LIKE '%tar%.config%'
OR p0_cmd LIKE '%.ssh/%'
OR p0_cmd LIKE '%tar%.local/share%'
OR p0_cmd LIKE '%.config%gcloud%'
OR p0_cmd LIKE '%.aws/%'
OR p0_cmd LIKE '%.mozilla%firefox%'
OR p0_cmd LIKE '%.config/%chrome%'
OR p0_cmd LIKE '%tar%.config%'
OR p0_cmd LIKE '%systemctl stop firewalld%'
OR p0_cmd LIKE '%systemctl disable firewalld%'
OR p0_cmd LIKE '%pkill -f%'