Merge pull request #241 from mnrkbys/fix_deleted.yaml

Fixed deleted.yaml
tclahr · Jul 3, 2024 · 72bfa92 · 72bfa92
2 parents ece2c69 + 8438a4d
commit 72bfa92
Showing 1 changed file with 3 additions and 4 deletions.
diff --git a/artifacts/live_response/process/deleted.yaml b/artifacts/live_response/process/deleted.yaml
@@ -69,10 +69,9 @@ artifacts:
   -
     description: Find open files of (malicious) processes.
     supported_os: [linux]
-    collector: find
-    path: .list_open_file_descriptors.txt
-    is_file_list: true
-    file_type: f
+    collector: command
+    foreach: cat "%destination_directory%/.list_open_file_descriptors.txt"
+    command: find %line% -type f -print
     output_file: .open_file_descriptors.txt
   -
     description: Collect open files of (malicious) processes.