Merge pull request #58 from tstromberg/fp45

New exclsuions: /tmp/.DS_Store, JSON files, LogiTune weirdness, melange build

detection/evasion/unexpected-hidden-system-folders.sql

@@ -63,6 +63,7 @@ WHERE
     '/.file',
     '/tmp/../',
     '/tmp/./',
+    '/tmp/.DS_Store',
     '/tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress',
     '/tmp/._contentbarrier_installed',
     '/tmp/.dotnet/',

detection/evasion/unexpected-var-executables-linux.sql

@@ -50,4 +50,5 @@ WHERE
     '/var/run/booted-system',
     '/var/run/current-system'
   )
+  AND magic.data NOT IN ('JSON data')
   AND file.size > 10

detection/execution/exotic-command-events-macos.sql

@@ -27,15 +27,20 @@ SELECT
   hash.sha256,
   pp.path AS parent_path,
   pp.name AS parent_name,
+  ppp.path AS gparent_path,
+  ppp.name AS gparent_name,
   TRIM(p.cmdline) AS parent_cmd,
   pp.euid AS parent_euid,
-  phash.sha256 AS parent_sha256
+  phash.sha256 AS parent_sha256,
+  gphash.sha256 AS gparent_sha256
 FROM
   uptime,
   process_events p
   LEFT JOIN processes pp ON p.parent = pp.pid
+  LEFT JOIN processes ppp ON pp.parent = ppp.pid
   LEFT JOIN hash ON p.path = hash.path
   LEFT JOIN hash AS phash ON pp.path = phash.path
+  LEFT JOIN hash AS gphash ON ppp.path = gphash.path
 WHERE
   p.time > (strftime('%s', 'now') -45)
   AND (
@@ -125,3 +130,4 @@ WHERE
   AND NOT cmd LIKE 'rm -f /tmp/locate%/mklocate%/_mklocatedb%'
   AND NOT cmd LIKE 'rm -f /tmp/insttmp_%'
   AND NOT cmd LIKE 'touch -r /tmp/KSInstallAction.%'
+  AND NOT cmd LIKE '%find /Applications/LogiTuneInstaller.app -type d -exec chmod 777 {}%'

detection/privesc/unexpected-privileged-containers.sql

@@ -31,4 +31,5 @@ WHERE
     'cgr.dev/chainguard/melange',
     'wolfi:test',
     'distroless.dev/melange:latest'
-  );
+  )
+  AND command NOT LIKE '/usr/bin/melange build %'