RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-18 03:54:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

unexpected fetcher parents: add Cursor Helper

Browse Source
This commit is contained in:
Thomas Stromberg 2024-10-24 15:34:04 -04:00
parent f038dc7557
commit 0b41ec5d07
Failed to extract signature
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
detection/execution/unexpected-fetcher-parents.sql
View File

@ -53,11 +53,15 @@ WHERE -- NOTE: The remainder of this query is synced with unexpected-fetcher-par
'curl,303,bash,nix', 'curl,303,bash,nix',
'curl,305,bash,nix', 'curl,305,bash,nix',
'curl,307,bash,nix', 'curl,307,bash,nix',
'curl,500,ShellLauncher,',
'curl,500,ShellLauncher,login',
'curl,500,Slack,launchd',
'curl,500,Stats,bash',
'curl,500,bash,ShellLauncher',
'curl,500,bash,bash', 'curl,500,bash,bash',
'curl,500,bash,fakeroot', 'curl,500,bash,fakeroot',
'curl,500,bash,fish', 'curl,500,bash,fish',
'curl,500,bash,nix-daemon', 'curl,500,bash,nix-daemon',
'curl,500,bash,ShellLauncher',
'curl,500,bash,zsh', 'curl,500,bash,zsh',
'curl,500,colima,zsh', 'curl,500,colima,zsh',
'curl,500,endpoint-instal,bash', 'curl,500,endpoint-instal,bash',
@ -71,11 +75,8 @@ WHERE -- NOTE: The remainder of this query is synced with unexpected-fetcher-par
'curl,500,nvim,nvim', 'curl,500,nvim,nvim',
'curl,500,nwg-panel,systemd', 'curl,500,nwg-panel,systemd',
'curl,500,ruby,zsh', 'curl,500,ruby,zsh',
'curl,500,ShellLauncher,',
'curl,500,ShellLauncher,login',
'curl,500,Slack,launchd',
'curl,500,Stats,bash',
'curl,500,zsh,Code Helper', 'curl,500,zsh,Code Helper',
'curl,500,zsh,Cursor Helper',
'curl,500,zsh,Emacs-arm64-11', 'curl,500,zsh,Emacs-arm64-11',
'curl,500,zsh,Hyper', 'curl,500,zsh,Hyper',
'curl,500,zsh,login', 'curl,500,zsh,login',
@ -92,6 +93,7 @@ WHERE -- NOTE: The remainder of this query is synced with unexpected-fetcher-par
AND gparent_name IN ( AND gparent_name IN (
'alacritty', 'alacritty',
'Code Helper', 'Code Helper',
'Cursor Helper',
'emacs', 'emacs',
'bash', 'bash',
'gnome-terminal-', 'gnome-terminal-',