mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
12 lines
348 B
YAML
12 lines
348 B
YAML
|
name: curl_certificate
|
||
|
|
examples: >-
|
||
|
|
Identify the certificates being served to osquery clients. This can allow you
|
||
|
|
to detect machines that are behind a proxy or firewall attempting to decrypt
|
||
|
|
TLS, maliciously or not.
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
SELECT issuer_organization, signature, sha256_fingerprint FROM curl_certificate WHERE hostname='google.com';
|
||
|
|
|
||
|
|
```
|