From fbf9a565c6bfef13790b4adc8ede1a942ad9fd24 Mon Sep 17 00:00:00 2001 From: Dave Smith Date: Wed, 23 Oct 2024 10:02:37 -0400 Subject: [PATCH] Update evenly-timestomped.sql Signed-off-by: Dave Smith --- detection/impact/evenly-timestomped.sql | 2 -- 1 file changed, 2 deletions(-) diff --git a/detection/impact/evenly-timestomped.sql b/detection/impact/evenly-timestomped.sql index 8bdf7a8..05f29b8 100644 --- a/detection/impact/evenly-timestomped.sql +++ b/detection/impact/evenly-timestomped.sql @@ -26,7 +26,6 @@ WHERE OR file.path LIKE "/etc/%%" OR file.path LIKE "/sbin/%%" OR file.path LIKE "/lib/%%" - OR file.path LIKE "/usr/%%" ) -- This timestamp is in UTC AND file.mtime > (strftime('%s', 'now') - (86400 * 720)) @@ -51,4 +50,3 @@ WHERE AND file.path NOT LIKE '%/lynis%' AND file.path NOT LIKE '%/yelp-xsl%' AND file.path NOT LIKE '/etc/cups/%' - AND file.path NOT LIKE '/usr/%'