osquery-defense-kit/detection/privesc/unexpected-privileged-containers.sql
2022-10-13 14:59:32 -04:00

8 lines
98 B
SQL

SELECT
*
FROM
docker_containers
WHERE
privileged = 1
AND image NOT LIKE 'kindest/node:%';