RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-17 01:47:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add exception for JetBrains Toolbox

Browse Source
This commit is contained in:
Thomas Stromberg 2022-12-15 10:25:35 -05:00
parent 26a800d52b
commit 0b8a67a48f
Failed to extract signature
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
detection/c2/unexpected-talkers-linux.sql
View File

@ -148,6 +148,13 @@ WHERE
'993,6,500,/app/thunderbird,u,g,thunderbird',
'993,6,500,/usr/thunderbird,0u,0g,thunderbird'
)
AND NOT (
p.name = 'java'
AND p.cmdline LIKE '/home/%/.local/share/JetBrains/Toolbox/%'
AND s.remote_port > 1024
AND s.protocol = 6
AND p.euid > 500
)
AND NOT (
p.name = 'syncthing'
AND f.filename = 'syncthing'