Fix a potential race condition in unique_cmd_parent
@@ -3,7 +3,7 @@ from typing import Any, Type
from grapl_analyzerlib.analyzer import Analyzer, OneOrMany, A
from grapl_analyzerlib.counters import ParentChildCounter
from grapl_analyzerlib.execution import ExecutionHit
-from grapl_analyzerlib.prelude import ProcessQuery, ProcessView, Not
+from grapl_analyzerlib.prelude import AssetQuery, ProcessQuery, ProcessView, Not
from pydgraph import DgraphClient
@@ -39,6 +39,7 @@ class RareParentOfCmd(Analyzer):
ProcessQuery()
.with_process_name(eq=parent_whitelist)
.with_children(ProcessQuery().with_process_name(eq="cmd.exe"))
+ .with_asset(AssetQuery().with_hostname())
)
def on_response(self, response: ProcessView, output: Any) -> None:
