mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2024-12-17 03:24:30 +00:00
19 lines
371 B
SQL
19 lines
371 B
SQL
-- Find programs which have cleared their environment
|
|
--
|
|
-- references:
|
|
-- * https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
|
|
--
|
|
-- tags: persistent state daemon process
|
|
SELECT
|
|
COUNT(*) AS count,
|
|
p.pid,
|
|
p.path,
|
|
p.cmdline
|
|
FROM
|
|
process_envs pe
|
|
JOIN processes p ON pe.pid = p.pid
|
|
GROUP BY
|
|
p.pid
|
|
HAVING
|
|
count == 0;
|