Filtering out empty file sha256

osquery · Nov 13, 2017 · 437590f · 437590f
1 parent 15ef86d
commit 437590f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/packs/windows-attacks.conf b/packs/windows-attacks.conf
@@ -59,7 +59,8 @@
         AND sha256 IN (SELECT sha256 FROM hash \
           WHERE path='c:\\windows\\system32\\cmd.exe' \
           OR path='c:\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe' \
-          OR path='c:\\windows\\system32\\explorer.exe');",
+          OR path='c:\\windows\\system32\\explorer.exe') \
+          AND sha256!='e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';",
       "interval": 3600,
       "version": "2.2.1",
       "description": "Checks the hashes of accessibility tools to ensure they don't match the hashes of cmd.exe, powershell.exe, or explorer.exe. More info: (https://github.com/TrullJ/sticky-keys-scanner/blob/master/TestFor-StickyKey.ps1)"