Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secured protected virtual processes #7121

Merged

Conversation

nickcollier
Copy link
Contributor

Find processes that are secured (IUM), protected or virtual on Windows #7120

@@ -32,6 +32,9 @@ schema([
])
extended_schema(WINDOWS, [
Column("is_elevated_token", INTEGER, "Process uses elevated token yes=1, no=0"),
Column("is_secure_process", INTEGER, "Process is secure (IUM) yes=1, no=0"),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick and for general consistency I prefer if we avoid the is_ prefix for column names. This is because the column type implies the verb. Could we name this secure_process, etc?

We can change the is_elevated_token to just elevated_token as well?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was trying to be consistent following is_elevated_token 😄
I've changed them all as suggested now.

@theopolis theopolis merged commit d7439de into osquery:master May 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants