RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-19 03:50:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #34 from tstromberg/zoom-exc

Browse Source 
osascript: Add exception for Zoom controller
This commit is contained in:
Thomas Strömberg 2022-10-24 13:58:57 -04:00 committed by GitHub
commit 159c864e58
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
detection/execution/unexpected-osascript-calls.sql
View File

@ -32,7 +32,10 @@ FROM
WHERE WHERE
p.path = '/usr/bin/osascript' p.path = '/usr/bin/osascript'
AND p.time > (strftime('%s', 'now') -60) AND p.time > (strftime('%s', 'now') -60)
AND exception_key != 'com.vng.zalo,Developer ID Application: VNG ONLINE CO.,LTD (CVB6BX97VM),osascript -ss' AND exception_key NOT IN (
'com.vng.zalo,Developer ID Application: VNG ONLINE CO.,LTD (CVB6BX97VM),osascript -ss',
',,osascript -e set zoomStatus to "closed"\x0Aset muteStatu'
)
AND cmd != 'osascript -e user locale of (get system info)' AND cmd != 'osascript -e user locale of (get system info)'
AND NOT ( AND NOT (
exception_key='org.python.python,,osascript' AND parent_cmd LIKE '% /opt/homebrew/bin/jupyter-notebook' exception_key='org.python.python,,osascript' AND parent_cmd LIKE '% /opt/homebrew/bin/jupyter-notebook'