mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-01-18 11:30:45 +00:00
23 lines
494 B
SQL
23 lines
494 B
SQL
-- Find launchd entries which purport to be by Apple, but are not signed by Apple.
|
|
--
|
|
-- references:
|
|
-- * https://posts.specterops.io/hunting-for-bad-apples-part-1-22ef2b44c0aa
|
|
--
|
|
-- false positives:
|
|
-- * none have been observed
|
|
--
|
|
-- platform: darwin
|
|
-- tags: persistent launchd state
|
|
select
|
|
*
|
|
FROM
|
|
signature s
|
|
JOIN launchd d ON d.program_arguments = s.path
|
|
WHERE
|
|
d.name LIKE 'com.apple.%'
|
|
AND (
|
|
signed = 0
|
|
OR authority != 'Software Signing'
|
|
)
|
|
AND d.run_at_load = 1;
|