RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-18 03:54:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore syncthing, nuclei, fix typos

Browse Source
This commit is contained in:
Thomas Stromberg 2023-12-15 17:19:38 -05:00
parent 8b9894ec74
commit 202ce6be45
Failed to extract signature
4 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/evasion/hidden-home-libappsupport.sql
View File

@ -52,6 +52,7 @@ WHERE
'~/Library/Application Support/CleanMyMac X Menu', '~/Library/Application Support/CleanMyMac X Menu',
'~/Library/Application Support/CleanMyMac X', '~/Library/Application Support/CleanMyMac X',
'~/Library/Application Support/Code', '~/Library/Application Support/Code',
'~/Library/Application Support/nuclei',
'~/Library/Application Support/Docker Desktop', '~/Library/Application Support/Docker Desktop',
'~/Library/Application Support/DropboxElectron', '~/Library/Application Support/DropboxElectron',
'~/Library/Application Support/GitHub Desktop', '~/Library/Application Support/GitHub Desktop',

4
detection/evasion/unexpected-user-executables-macos.sql
View File

@ -183,7 +183,7 @@ WHERE
'/Users/Shared/LogiOptionsPlus/cache', '/Users/Shared/LogiOptionsPlus/cache',
'/Users/Shared/Red Giant/Uninstall' '/Users/Shared/Red Giant/Uninstall'
) )
AND NOT directory LIKE '/Users/%/.docker/cli-plugins' AND NOT f.directory LIKE '/Users/%/.docker/cli-plugins'
AND NOT directory LIKE '/Users/%/.nix-profile/bin' AND NOT f.directory LIKE '/Users/%/.nix-profile/bin'
GROUP BY GROUP BY
f.path f.path

2
detection/execution/unexpected-execdir-macos.sql
View File

@ -65,7 +65,7 @@ WHERE
SELECT SELECT
pid pid
FROM FROM
processesP processes
WHERE WHERE
pid > 0 pid > 0
AND REGEX_MATCH ( AND REGEX_MATCH (

1
detection/persistence/unexpected-listening-port-macos.sql
View File

@ -54,6 +54,7 @@ WHERE
AND NOT exception_key IN ( AND NOT exception_key IN (
'10011,6,0,launchd,Software Signing', '10011,6,0,launchd,Software Signing',
'10011,6,0,webfilterproxyd,Software Signing', '10011,6,0,webfilterproxyd,Software Signing',
'22000,6,500,syncthing,Developer ID Application: Kastelo AB (LQE5SYM783)',
'1024,6,0,systemmigrationd,Software Signing', '1024,6,0,systemmigrationd,Software Signing',
'1313,6,500,hugo,', '1313,6,500,hugo,',
'1338,6,500,registry,', '1338,6,500,registry,',