osquery-defense-kit/incident_response/kernel_modules.sql

11 lines
247 B
SQL

-- Retrieves all the information for the current kernel modules in the target Linux system.
--
-- interval: 3600
-- platform: linux
-- value: Identify malware that has a kernel module component.
-- version: 1.4.5
select
*
from
kernel_modules;