RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Exclude _darwin_x paths in home

This commit is contained in:
Thomas Stromberg 2023-01-13 13:54:28 -05:00
parent 27dfda38ed
commit edc9e4b527
Failed to extract signature
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/execution/unexpected-gatekeeper-approvals-macos.sql
View File

@ -31,6 +31,8 @@ WHERE
AND gap.path NOT LIKE '/usr/local/bin/%'
AND gap.path NOT LIKE '/Users/%/%-darwin-amd64'
AND gap.path NOT LIKE '/Users/%/%-darwin-arm64'
AND gap.path NOT LIKE '/Users/%/%_darwin_amd64'
AND gap.path NOT LIKE '/Users/%/%_darwin_arm64'
AND gap.path NOT LIKE '/Users/%/configure'
AND gap.path NOT LIKE '/Users/%/trivy'
GROUP BY