RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #408 from chainguard-dev/r0cketlad-patch-1 

add extra tag to setxid-cmdline-overflow-attempt.sql
This commit is contained in:
Dave Smith 2024-10-24 19:37:25 -04:00 committed by GitHub
parent 59575e227b 7ad81b16c2
commit f59a4bdb58
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/privesc/setxid-cmdline-overflow-attempt.sql
View File

@ -2,7 +2,7 @@
-- --
-- platform: posix -- platform: posix
-- interval: 300 -- interval: 300
-- tags: events -- tags: events extra
SELECT SELECT
file.mode AS p0_binary_mode, file.mode AS p0_binary_mode,
pe.cmdline_size AS p0_cmd_size, pe.cmdline_size AS p0_cmd_size,