diff --git a/Linux/linux_home_root_hidden_file_directory.conf b/Linux/linux_home_root_hidden_file_directory.conf index 0eaa5c7..117490f 100644 --- a/Linux/linux_home_root_hidden_file_directory.conf +++ b/Linux/linux_home_root_hidden_file_directory.conf @@ -8,9 +8,9 @@ "description": "Lists hidden file in relevant path - ATT&CK T1158,T1100" }, "hidden_directories": { - "query": "SELECT hash.sha1, fi.path, fi.filename, datetime(fi.btime, 'unixepoch', 'UTC') as btime, datetime(fi.atime, 'unixepoch', 'UTC') as atime, datetime(fi.ctime, 'unixepoch', 'UTC') as ctime, datetime(fi.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file fi USING (path) where ((fi.path like '/home/%%/.%') OR (fi.path like '/root/.%')) AND type='directory';", + "query": "SELECT fi.path, fi.filename, datetime(fi.btime, 'unixepoch', 'UTC') as btime, datetime(fi.atime, 'unixepoch', 'UTC') as atime, datetime(fi.ctime, 'unixepoch', 'UTC') as ctime, datetime(fi.mtime, 'unixepoch', 'UTC') as mtime FROM file fi WHERE ((fi.path like '/home/%%/.%') OR (fi.path like '/root/.%')) AND type='directory';", "interval": 3600, - "description": "Lists hidden direcotry in relevant path - ATT&CK T1158" + "description": "Lists hidden directory in relevant path - ATT&CK T1158" } } }