RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix table joins: hash->phash

This commit is contained in:
Thomas Stromberg 2022-10-21 17:38:29 -04:00
parent e90dc53072
commit eedfdfb23d
Failed to extract signature
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
detection/privesc/unexpected-privilege-escalation-events.sql
View File

@ -30,8 +30,8 @@ FROM
JOIN processes pp ON p.parent = pp.pid JOIN processes pp ON p.parent = pp.pid
LEFT JOIN file ON p.path = file.path LEFT JOIN file ON p.path = file.path
LEFT JOIN hash ON p.path = hash.path LEFT JOIN hash ON p.path = hash.path
LEFT JOIN file AS pfile ON pp.path = file.path LEFT JOIN file AS pfile ON pp.path = pfile.path
LEFT JOIN hash AS phash ON pp.path = hash.path LEFT JOIN hash AS phash ON pp.path = phash.path
WHERE WHERE
p.time > (strftime('%s', 'now') -30) p.time > (strftime('%s', 'now') -30)
AND p.euid < pp.euid AND p.euid < pp.euid

4
detection/privesc/unexpected-privilege-escalation.sql
View File

@ -30,8 +30,8 @@ FROM
JOIN processes pp ON p.parent = pp.pid JOIN processes pp ON p.parent = pp.pid
LEFT JOIN file ON p.path = file.path LEFT JOIN file ON p.path = file.path
LEFT JOIN hash ON p.path = hash.path LEFT JOIN hash ON p.path = hash.path
LEFT JOIN file AS pfile ON pp.path = file.path LEFT JOIN file AS pfile ON pp.path = pfile.path
LEFT JOIN hash AS phash ON pp.path = hash.path LEFT JOIN hash AS phash ON pp.path = phash.path
WHERE WHERE
p.euid < pp.euid p.euid < pp.euid
AND p.path NOT IN ( AND p.path NOT IN (