From 0f954bdbe5bb5dd5316b82805e2e588ce785b228 Mon Sep 17 00:00:00 2001 From: Saulo Guilhermino Date: Tue, 18 Aug 2020 15:06:13 -0300 Subject: [PATCH] Update linux_home_root_hidden_file_directory.conf There is no hash to folders, so the second query returns an empty result. Querying only "file" columns works. --- Linux/linux_home_root_hidden_file_directory.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Linux/linux_home_root_hidden_file_directory.conf b/Linux/linux_home_root_hidden_file_directory.conf index 0eaa5c7..117490f 100644 --- a/Linux/linux_home_root_hidden_file_directory.conf +++ b/Linux/linux_home_root_hidden_file_directory.conf @@ -8,9 +8,9 @@ "description": "Lists hidden file in relevant path - ATT&CK T1158,T1100" }, "hidden_directories": { - "query": "SELECT hash.sha1, fi.path, fi.filename, datetime(fi.btime, 'unixepoch', 'UTC') as btime, datetime(fi.atime, 'unixepoch', 'UTC') as atime, datetime(fi.ctime, 'unixepoch', 'UTC') as ctime, datetime(fi.mtime, 'unixepoch', 'UTC') as mtime FROM hash JOIN file fi USING (path) where ((fi.path like '/home/%%/.%') OR (fi.path like '/root/.%')) AND type='directory';", + "query": "SELECT fi.path, fi.filename, datetime(fi.btime, 'unixepoch', 'UTC') as btime, datetime(fi.atime, 'unixepoch', 'UTC') as atime, datetime(fi.ctime, 'unixepoch', 'UTC') as ctime, datetime(fi.mtime, 'unixepoch', 'UTC') as mtime FROM file fi WHERE ((fi.path like '/home/%%/.%') OR (fi.path like '/root/.%')) AND type='directory';", "interval": 3600, - "description": "Lists hidden direcotry in relevant path - ATT&CK T1158" + "description": "Lists hidden directory in relevant path - ATT&CK T1158" } } }