mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-02-09 14:06:53 +00:00
15 lines
274 B
SQL
15 lines
274 B
SQL
-- Inspired by BPFdoor
|
|
-- https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
|
|
SELECT
|
|
COUNT(*) AS count,
|
|
p.pid,
|
|
p.path,
|
|
p.cmdline
|
|
FROM
|
|
process_envs pe
|
|
JOIN processes p ON pe.pid = p.pid
|
|
GROUP BY
|
|
p.pid
|
|
HAVING
|
|
count == 0;
|