30 lines
826 B
SQL
30 lines
826 B
SQL
-- Unexpected crontab entries
|
|
--
|
|
-- references:
|
|
-- * https://attack.mitre.org/techniques/T1053/003/ (Scheduled Task/Job: Cron)
|
|
--
|
|
-- false positives:
|
|
-- * crontab entries added by the user
|
|
--
|
|
-- tags: persistent filesystem state
|
|
-- platform: posix
|
|
SELECT
|
|
*
|
|
FROM
|
|
crontab
|
|
WHERE
|
|
command NOT LIKE 'root%run-parts%'
|
|
AND command NOT LIKE '%/usr/lib/php/sessionclean%'
|
|
AND command NOT LIKE '%anacron start%'
|
|
AND command NOT LIKE '%clamscan%'
|
|
AND command NOT LIKE '%e2scrub%'
|
|
AND command NOT LIKE '%freshclam%'
|
|
AND command NOT LIKE '%gcloud compute instances stop%'
|
|
AND command NOT LIKE '%git commit%'
|
|
AND command NOT LIKE '%rsync%'
|
|
AND command NOT LIKE '%zfs-linux%'
|
|
AND command NOT LIKE 'docker run amouat/jocko%'
|
|
AND command NOT LIKE 'gsutil %'
|
|
AND command NOT LIKE 'root command -v debian-sa1%'
|
|
|