mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-02-27 15:30:24 +00:00
11 lines
293 B
SQL
11 lines
293 B
SQL
SELECT pmm.pid,
|
|
p.uid,
|
|
p.path AS proc_path,
|
|
p.cmdline AS proc_cmdline,
|
|
pmm.path AS lib_path
|
|
FROM process_memory_map pmm
|
|
JOIN processes p ON pmm.pid = p.pid
|
|
WHERE (lib_path LIKE "%:bpf%" OR lib_path LIKE "%libbpf%")
|
|
AND p.path != '/usr/lib/systemd/systemd'
|
|
GROUP BY pmm.pid
|