RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-17 01:47:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Tighten down the field list, update metadata

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-14 09:16:24 -04:00
parent 4a7f734c81
commit dc9493ee1e
Failed to extract signature
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
detection/privesc/unexpected-privileged-containers.sql
View File

@ -4,12 +4,12 @@
-- * https://attack.mitre.org/techniques/T1611/
--
-- This query works on macOS as well, but is only an in-the-wild security problem on Linux,
-- where the kernel namespaces can be shared.
-- where the kernel namespaces can be shared. These kind of attacks tend to be
--
-- platform: linux
-- tags: ephemeral often
-- tags: ephemeral
SELECT
*
command, image_id, path, security_options, started_at, image
FROM
docker_containers
WHERE