osquery-defense-kit/detection/persistence
Thomas Stromberg fb7cd56249
fpr: abrt-dbus, gdm, chrome, ff, etc
2023-02-24 16:30:17 -05:00
..
fake-apple-launchd.sql Run make reformat, update max rows for incident response 2023-02-02 17:58:19 -05:00
unexpected-active-systemd-units.sql fpr: abrt-dbus, gdm, chrome, ff, etc 2023-02-24 16:30:17 -05:00
unexpected-chrome-extensions.sql False positive flush, particularly in talkers 2023-02-17 11:57:23 -05:00
unexpected-cron-entries.sql False positives: melange, ~/dev, debian-sa1, AdBlock, cover, kubelr, etc 2022-11-18 10:27:43 -05:00
unexpected-device.sql Add detectors for the reveng_rtkit rootkit 2023-02-23 17:05:11 -05:00
unexpected-launchd-program-arguments.sql fpr: Fujitsu, vmware, objective-see, paragon, etc 2023-02-18 12:02:40 -08:00
unexpected-launchd-program-macos.sql Refactor process_events queries for more accurate parenting 2023-01-26 11:40:54 -05:00
unexpected-listening-port-linux.sql fpr: abrt-dbus, gdm, chrome, ff, etc 2023-02-24 16:30:17 -05:00
unexpected-listening-port-macos.sql fpr: abrt-dbus, gdm, chrome, ff, etc 2023-02-24 16:30:17 -05:00
unexpected-small-udev-entry-linux.sql Remove ubuntu-lts false-positives on lima 2023-02-20 19:10:12 -05:00
unexpected-ssh-authorized-keys.sql Remove ubuntu-lts false-positives on lima 2023-02-20 19:10:12 -05:00
unexpected-systemctl-calls-linux.sql fpr: abrt-dbus, gdm, chrome, ff, etc 2023-02-24 16:30:17 -05:00
unexpected-uid0-daemon-linux.sql fpr: abrt-dbus, gdm, chrome, ff, etc 2023-02-24 16:30:17 -05:00
unexpected-uid0-daemon-macos.sql fpr: Fujitsu, vmware, objective-see, paragon, etc 2023-02-18 12:02:40 -08:00