Currently running programs, only the columns that are not constantly changing

Query · osquery

-- Currently running programs, only the columns that are not constantly changing
--
-- tags: postmortem often
-- platform: posix
SELECT
  pid,
  name,
  path,
  cmdline,
  state,
  cwd,
  root,
  uid,
  gid,
  euid,
  egid,
  suid,
  sgid,
  on_disk,
  start_time,
  parent,
  pgroup,
  threads,
  nice,
  cgroup_path
FROM
  processes
Raw source Currently running programs, only the columns that are not constantly changing · osquery SQL
Esc
Published by chainguard-dev/osquery-defense-kit ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
-- Currently running programs, only the columns that are not constantly changing
--
-- tags: postmortem often
-- platform: posix
SELECT
  pid,
  name,
  path,
  cmdline,
  state,
  cwd,
  root,
  uid,
  gid,
  euid,
  egid,
  suid,
  sgid,
  on_disk,
  start_time,
  parent,
  pgroup,
  threads,
  nice,
  cgroup_path
FROM
  processes

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.