swap extra tag between udev and systemd

2024-09-23 11:24:03 -04:00 · 2024-09-23 11:24:03 -04:00 · d14d5429e8
parent 5255539777
commit d14d5429e8
2 changed files with 2 additions and 2 deletions
--- a/detection/persistence/suspicious-systemd-unit.sql
+++ b/detection/persistence/suspicious-systemd-unit.sql
@ -8,7 +8,7 @@
 -- false positives:
 --   * home-made systemd files
 --
-- tags: persistent filesystem systemd
+-- tags: persistent filesystem systemd extra
 -- platform: linux
 SELECT
  file.path,
--- a/detection/persistence/suspicious-udev-runner-linux.sql
+++ b/detection/persistence/suspicious-udev-runner-linux.sql
@ -4,7 +4,7 @@
 --  * https://www.aon.com/en/insights/cyber-labs/unveiling-sedexp
 --  * https://ch4ik0.github.io/en/posts/leveraging-Linux-udev-for-persistence/
 --
-- tags: volume filesystem extra
+-- tags: volume filesystem
 -- platform: linux
 SELECT
  file.path,