osquery-defense-kit/detection/privesc
Thomas Stromberg 066c88dc18 fpr: multipass, go, macOS, Ubuntu, Opera, git, ko 2023-06-02 19:08:08 -04:00
..
docker-container-mounting-root.sql Query performance improvements, add pids, decrease frequency 2023-02-09 17:01:29 -05:00
setxid-cmdline-overflow-attempt.sql Make process times broadly available, minor opts 2023-05-16 17:18:39 -04:00
setxid-env-overflow-attempt.sql Make process times broadly available, minor opts 2023-05-16 17:18:39 -04:00
sketchy-docker-image-creator.sql Query performance improvements, add pids, decrease frequency 2023-02-09 17:01:29 -05:00
unexpected-elevated-children-events_linux.sql fpr: multipass, go, macOS, Ubuntu, Opera, git, ko 2023-06-02 19:08:08 -04:00
unexpected-elevated-children-events_macos.sql fpr: macOS, yubikey, Premiere, dnf, vagrant, etc 2023-05-23 11:31:37 -04:00
unexpected-privilege-escalation_linux.sql make reformat 2023-05-08 13:20:47 -04:00
unexpected-privilege-escalation_macos.sql Query tuning after Geacon testing 2023-05-17 10:54:16 -04:00
unexpected-privileged-containers.sql fpr: libopenblas, snapd, k3d, opera, nix, ssh, cargo, adobe installer 2023-05-03 16:28:00 -04:00
unexpected-setxid-process.sql fpr: Chrome, Kolide 2023-05-12 16:41:17 -04:00