Merge pull request #206 from tstromberg/kindle

macOS: Exceptions for TestFlight apps & specifically Kindle

detection/c2/unexpected-talkers-macos.sql

@@ -176,6 +176,7 @@ WHERE
     '443,6,0,Setup,com.adobe.acc.Setup,Developer ID Application: Adobe Inc. (JQ525L2MZD)',
     '443,6,500,,,',
     '443,6,500,steampipe-plugin-aws.plugin,a.out,',
+    '443,6,500,Kindle,com.amazon.Lassen,TestFlight Beta Distribution',
     '443,6,500,Acrobat Update Helper,com.adobe.ARMDCHelper,Developer ID Application: Adobe Inc. (JQ525L2MZD)',
     '443,6,500,apko,a.out,',
     '443,6,500,aws,37c466-aws,Developer ID Application: AMZN Mobile LLC (94KV3E626L)',

detection/execution/recently-created-executables-macos.sql

@@ -93,6 +93,10 @@ WHERE
       AND NOT path LIKE '/usr/local/Cellar/%'
       AND NOT path LIKE '/usr/sbin/%'
       AND NOT path LIKE '%/.vscode/extensions/%'
+      AND NOT (
+        path LIKE '/private/var/folders/%/d/Wrapper/%.app/%'
+        AND s.authority = 'TestFlight Beta Distribution'
+      )
   )
   AND f.ctime > 0
   AND (p0.start_time - MAX(f.ctime, f.btime)) < 180

detection/execution/unexpected-execdir-events-macos.sql

@@ -218,6 +218,7 @@ WHERE
   AND dir NOT LIKE '/private/var/folders/%/Contents/%'
   AND dir NOT LIKE '/private/var/folders/%/go-build%'
   AND dir NOT LIKE '/private/var/folders/%/GoLand'
+  AND dir NOT LIKE '/private/var/folders/%/d/Wrapper/%.app'
   AND dir NOT LIKE '~/%repo%'
   AND dir NOT LIKE '~/%sigstore%'
   AND dir NOT LIKE '%/.terraform/providers/%'