From 462fbef63946a79f189b00b227dfcd3876db216b Mon Sep 17 00:00:00 2001 From: Thomas Stromberg Date: Thu, 24 Oct 2024 15:36:21 -0400 Subject: [PATCH] Mark as extra, as this query is racey --- detection/execution/unexpected-fetcher-parents.sql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection/execution/unexpected-fetcher-parents.sql b/detection/execution/unexpected-fetcher-parents.sql index 845917a..d15f043 100644 --- a/detection/execution/unexpected-fetcher-parents.sql +++ b/detection/execution/unexpected-fetcher-parents.sql @@ -3,7 +3,7 @@ -- refs: -- * https://attack.mitre.org/techniques/T1105/ (Ingress Tool Transfer) -- --- tags: transient process state often +-- tags: transient process state often extra -- platform: posix SELECT p.pid,