RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sort talker list

This commit is contained in:
Thomas Stromberg 2022-10-20 08:20:06 -04:00
parent a43ee03929
commit 1a54cebb55
Failed to extract signature
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
detection/c2/unexpected-talkers-linux.sql
View File

@ -81,16 +81,16 @@ WHERE protocol > 0
'22000,6,500,/usr/syncthing,0u,0g,syncthing',
'4070,6,500,/opt/spotify,0u,0g,spotify',
'5228,6,500,/opt/chrome,0u,0g,chrome',
'80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra'
'80,6,0,/usr/tailscaled,0u,0g,tailscaled',
'80,6,500,/opt/chrome,0u,0g,chrome',
'80,6,500,/usr/firefox,0u,0g,firefox',
'8000,6,500,/opt/chrome,0u,0g,chrome',
'8000,6,500,/usr/firefox,0u,0g,firefox',
'80,6,0,/usr/tailscaled,0u,0g,tailscaled',
'80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra',
'80,6,500,/opt/chrome,0u,0g,chrome',
'80,6,500,/usr/firefox,0u,0g,firefox',
'8080,6,500,/opt/chrome,0u,0g,chrome',
'8080,6,500,/usr/firefox,0u,0g,firefox',
'8443,6,500,/opt/chrome,0u,0g,chrome',
'8443,6,500,/usr/firefox,0u,0g,firefox',
'8443,6,500,/usr/firefox,0u,0g,firefox'
)
AND NOT (
p.name = 'syncthing'