RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-10 07:39:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #83 from tstromberg/more-flushing5

Browse Source 
var executables: put quote marks around modes with leading zeros
This commit is contained in:
Thomas Strömberg 2022-11-11 07:54:20 -05:00 committed by GitHub
commit fba85e03a5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
detection/evasion/unexpected-var-executables-macos.sql
View File

@ -95,11 +95,11 @@ WHERE
file.path LIKE '/var/db/timezone/zoneinfo/%'
AND magic.data LIKE 'timezone%'
AND file.size < 3000
AND file.mode = 0755
AND file.mode = '0755'
)
-- JetBrains (Delve)
AND NOT (
file.path LIKE '/var/folders/%/%/T/dlvLauncher.sh'
AND file.size < 1024
AND file.mode = 0744
AND file.mode = '0744'
)