osquery-defense-kit/detection/persistence
Thomas Stromberg 9eed574026
fpr: sharingd, sparkle, golang, Snagit
2023-05-05 15:10:54 -04:00
..
fake-apple-launchd.sql Run make reformat, update max rows for incident response 2023-02-02 17:58:19 -05:00
unexpected-active-systemd-units.sql fpr: cleanup and new additions 2023-04-27 12:00:08 -04:00
unexpected-chrome-extensions.sql fpr: libopenblas, snapd, k3d, opera, nix, ssh, cargo, adobe installer 2023-05-03 16:28:00 -04:00
unexpected-cron-entries.sql
unexpected-device.sql fpr: node, nc, busybox, libvirt, etc 2023-05-05 12:44:46 -04:00
unexpected-launchd-program-arguments.sql fpr everything 2023-04-17 16:20:35 -04:00
unexpected-launchd-program-macos.sql fpr: lghub, brew, pve, chrome exts, etc 2023-04-20 20:45:35 -04:00
unexpected-listening-port-linux.sql fpr: lghub, brew, pve, chrome exts, etc 2023-04-20 20:45:35 -04:00
unexpected-listening-port-macos.sql fpr: sharingd, sparkle, golang, Snagit 2023-05-05 15:10:54 -04:00
unexpected-small-udev-entry-linux.sql fpr: microbit, i3, Grammarly for Safari, wine 2023-05-02 17:49:53 -04:00
unexpected-ssh-authorized-keys.sql Remove ubuntu-lts false-positives on lima 2023-02-20 19:10:12 -05:00
unexpected-systemctl-calls-linux.sql fpr: node, nc, busybox, libvirt, etc 2023-05-05 12:44:46 -04:00
unexpected-uid0-daemon-linux.sql fpr: node, nc, busybox, libvirt, etc 2023-05-05 12:44:46 -04:00
unexpected-uid0-daemon-macos.sql fpr everything 2023-04-17 16:20:35 -04:00