RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add LittleSnitch exception_key 

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
This commit is contained in:
egibs 2024-07-12 13:12:43 -05:00
parent 82f4957484
commit 03789d2957
Failed to extract signature
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
detection/c2/unexpected-talkers-macos.sql
View File

@ -192,7 +192,8 @@ WHERE pos.protocol > 0
'500,6,993,Mimestream,Mimestream,Developer ID Application: Mimestream, LLC (P2759L65T8),com.mimestream.Mimestream',
'500,6,993,Spark Desktop Helper,Spark Desktop Helper,Developer ID Application: Readdle Technologies Limited (3L68KQB4HG),com.readdle.SparkDesktop.helper',
'500,6,993,thunderbird,thunderbird,Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.thunderbird',
'500,6,995,KakaoTalk,KakaoTalk,Apple Mac OS Application Signing,com.kakao.KakaoTalkMac'
'500,6,995,KakaoTalk,KakaoTalk,Apple Mac OS Application Signing,com.kakao.KakaoTalkMac',
'0,6,853,at.obdev.littlesnitch.networkextension,at.obdev.littlesnitch.networkextension,0u,0g'
) -- Useful for unsigned binaries
AND NOT alt_exception_key IN (
'0,6,80,tailscaled,tailscaled,500u,80g',
@ -292,4 +293,4 @@ WHERE pos.protocol > 0
'Developer ID Application: Zwift, Inc (C2GM8Y9VFM),ZwiftAppSilicon'
)
)
GROUP BY p0.cmdline
GROUP BY p0.cmdline