Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 01:18:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 84

Standard query library updates (#2546)

Browse source 
* update Floxif trojan query description, Add puffyCid's query, update query description styles

* Update standard-query-library.yml
This commit is contained in:
eashaw 2021-10-22 16:58:34 -05:00 committed by GitHub
parent 36babcc510
commit 675f14b16b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
docs/01-Using-Fleet/standard-query-library/standard-query-library.yml
View file

@ -502,7 +502,17 @@ kind: query
spec:
name: Check for artifacts of the Floxif trojan
platforms: Windows
description: See https://github.com/osquery/osquery/blob/b8085572ed1a58ff635683e5f2225cd49cd27bc1/packs/windows-attacks.conf#L4-L10
query: select * from registry where path like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Piriform\\Agomo%';,
description: Checks for artifacts from the Floxif trojan on Windows machines.
query: select * from registry where path like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Piriform\\Agomo%';
purpose: Informational
contributors: micheal-o
---
apiVersion: v1
kind: query
spec:
name: Get shimcache table
platforms: Windows
description: Returns forensic data showing evidence of likely file execution, in addition to the last modified timestamp of the file, order of execution, full file path order of execution, and the order in which files were executed.
query: select * from shimcache
purpose: Informational
contributors: puffyCid

1
website/assets/styles/pages/query-detail.less vendored
View file

@ -10,6 +10,7 @@
font-family: 'Nunito';
font-size: 16px;
line-height: 25px;
word-wrap: break-word;
}
p {