Add exception for snap container mounts

2025-01-10 07:39:26 +00:00 · 2022-11-16 10:39:21 -05:00 · 2022-11-16 10:39:21 -05:00 · e8ee572311
commit e8ee572311
parent f36b74c487
1 changed files with 1 additions and 0 deletions
--- a/detection/evasion/parent-missing-from-disk.sql
+++ b/detection/evasion/parent-missing-from-disk.sql
@ -58,6 +58,7 @@ WHERE
  )
  AND parent_path NOT LIKE '/app/extra/%'
  AND parent_path NOT LIKE '/opt/homebrew/Cellar/%'
+  AND parent_path NOT LIKE '/tmp/.mount_%/%'
  AND NOT (
    parent_name LIKE 'kworker/%+events_unbound'
    AND child_name IN ('modprobe')