RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for .pkg files

This commit is contained in:
Thomas Stromberg 2023-01-13 13:47:02 -05:00
parent 1bd030a2f2
commit dd3149a34b
Failed to extract signature
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/initial_access/unexpected-diskimage-source-macos.sql
View File

@ -27,6 +27,7 @@ WHERE
( (
mdfind.query = "kMDItemWhereFroms != '' && kMDItemFSName == '*.iso'" mdfind.query = "kMDItemWhereFroms != '' && kMDItemFSName == '*.iso'"
OR mdfind.query = "kMDItemWhereFroms != '' && kMDItemFSName == '*.dmg'" OR mdfind.query = "kMDItemWhereFroms != '' && kMDItemFSName == '*.dmg'"
OR mdfind.query = "kMDItemWhereFroms != '' && kMDItemFSName == '*.pkg'"
) )
AND ea.key = 'where_from' AND ea.key = 'where_from'
AND file.btime > (strftime('%s', 'now') -86400) AND file.btime > (strftime('%s', 'now') -86400)