RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update evenly-timestomped.sql 

Signed-off-by: Dave Smith <dave.smith@chainguard.dev>
This commit is contained in:
Dave Smith 2024-10-23 10:02:37 -04:00 committed by GitHub
parent 899fc1dfca
commit fbf9a565c6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/impact/evenly-timestomped.sql
View File

@ -26,7 +26,6 @@ WHERE
OR file.path LIKE "/etc/%%" OR file.path LIKE "/etc/%%"
OR file.path LIKE "/sbin/%%" OR file.path LIKE "/sbin/%%"
OR file.path LIKE "/lib/%%" OR file.path LIKE "/lib/%%"
OR file.path LIKE "/usr/%%"
) )
-- This timestamp is in UTC -- This timestamp is in UTC
AND file.mtime > (strftime('%s', 'now') - (86400 * 720)) AND file.mtime > (strftime('%s', 'now') - (86400 * 720))
@ -51,4 +50,3 @@ WHERE
AND file.path NOT LIKE '%/lynis%' AND file.path NOT LIKE '%/lynis%'
AND file.path NOT LIKE '%/yelp-xsl%' AND file.path NOT LIKE '%/yelp-xsl%'
AND file.path NOT LIKE '/etc/cups/%' AND file.path NOT LIKE '/etc/cups/%'
AND file.path NOT LIKE '/usr/%'