mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 08:58:41 +00:00
parent
a42dd708d6
commit
0ef72c36ce
3 changed files with 36 additions and 0 deletions
10
schema/tables/etc_services.yml
Normal file
10
schema/tables/etc_services.yml
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
name: etc_services
|
||||
examples: >-
|
||||
Identify the TCP and UDP ports associated to standard services.
|
||||
|
||||
```
|
||||
|
||||
SELECT * FROM etc_services WHERE name='ftp';
|
||||
|
||||
```
|
||||
|
||||
10
schema/tables/power_sensors.yml
Normal file
10
schema/tables/power_sensors.yml
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
name: power_sensors
|
||||
notes: Returns useful results on Intel Macs only.
|
||||
examples: >-
|
||||
See the total power usage of an Intel Mac.
|
||||
|
||||
```
|
||||
|
||||
SELECT * FROM power_sensors WHERE key='PSTR';
|
||||
|
||||
```
|
||||
16
schema/tables/yara.yml
Normal file
16
schema/tables/yara.yml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
name: yara
|
||||
examples: >-
|
||||
Look for files under `/root` that match a Yara signature. This example uses the [EICAR test file](https://www.eicar.org/download-anti-malware-testfile/).
|
||||
|
||||
```
|
||||
|
||||
SELECT * FROM yara WHERE path like '/root/%%' AND sigrule IN (
|
||||
'rule eicar {
|
||||
strings:
|
||||
$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
|
||||
condition:
|
||||
all of them
|
||||
}'
|
||||
) AND matches='eicar';
|
||||
|
||||
```
|
||||
Loading…
Reference in a new issue