mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2024-12-18 03:54:30 +00:00
30 lines
1.0 KiB
SQL
30 lines
1.0 KiB
SQL
SELECT et.enabled, et.process_being_tapped, et.tapping_process,
|
|
p.path,
|
|
s.authority,
|
|
s.identifier,
|
|
h.sha256,
|
|
CONCAT(
|
|
REPLACE(
|
|
p.path,
|
|
RTRIM(p.path, REPLACE(p.path, '/', '')),
|
|
''
|
|
),
|
|
",",
|
|
identifier,
|
|
",",
|
|
authority
|
|
) AS exception_key
|
|
FROM event_taps et
|
|
LEFT JOIN processes p ON et.tapping_process = p.pid
|
|
LEFT JOIN signature s ON s.path = p.path
|
|
LEFT JOIN hash h ON h.path = p.path
|
|
WHERE event_tapped IN ('EventKeyDown', 'EventKeyUp')
|
|
AND authority != "Software Signing"
|
|
AND NOT exception_key IN (
|
|
'iTerm2,com.googlecode.iterm2,Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D)',
|
|
'lghub_agent,com.logi.ghub.agent,Developer ID Application: Logitech Inc. (QED4VVPZWA)',
|
|
'logioptionsplus_agent,com.logi.cp-dev-mgr,Developer ID Application: Logitech Inc. (QED4VVPZWA)',
|
|
"MonitorControl,me.guillaumeb.MonitorControl,Developer ID Application: Joni Van Roost (CYC8C8R4K9)",
|
|
'skhd,skhd,'
|
|
)
|
|
GROUP BY p.path |