osquery-defense-kit/incident_response/authorized_keys.sql

10 lines
210 B
SQL

-- Retrieves all the currently installed authorized keys on a system
--
-- tags: postmortem
-- platform: posix
SELECT
authorized_keys.*
FROM
users
JOIN authorized_keys ON users.uid = authorized_keys.uid;