slevchenko
01/31/2022, 8:17 AMfile_path
list, for the rest file_events
are generated
{
"file_paths": {
"binaries": [
"/usr/bin/%%", <-- Yara events generated
"/usr/sbin/%%", # <-- file_events generated, but NOT yara_events!
"/bin/%%", # <--|
"/sbin/%%", # <--|
"/usr/local/bin/%%", # <--|
"/usr/local/sbin/%%" # <--|
],
"configuration": [
"/etc/init/%%", <-- Yara events generated
"/etc/passwd",
"/etc/shadow",
"/etc/ld.so.preload",
"/etc/ld.so.conf",
"/etc/ld.so.conf.d/%%", # <-- file_events generated, but NOT yara_events!
"/etc/pam.d/%%", # <--| file_events generated, but NOT yara_events!
"/etc/resolv.conf",
"/etc/rc%/%%", # <-- file_events generated, but NOT yara_events!
"/etc/my.cnf",
"/etc/modules",
"/etc/hosts",
"/etc/hostname",
"/etc/fstab",
"/etc/crontab",
"/etc/cron%/%%", # <-- file_events generated, but NOT yara_events!
"/etc/rsyslog.conf"
]
},
"yara": {
"file_paths": {
"binaries": [
"eicar",
"custom"
],
"configuration": [
"eicar",
"custom"
]
},
"signatures": {
"custom": [
"/opt/osquery/yara/custom.yar"
],
"eicar": [
"/opt/osquery/yara/eicar.yar"
]
}
}
}
Stefano Bonicatti
01/31/2022, 3:18 PMslevchenko
01/31/2022, 3:44 PMStefano Bonicatti
02/01/2022, 12:01 PMslevchenko
02/01/2022, 3:12 PM