RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #206 from tstromberg/kindle 

macOS: Exceptions for TestFlight apps & specifically Kindle
This commit is contained in:
Thomas Strömberg 2023-02-24 17:08:54 -05:00 committed by GitHub
parent 5f1d801b68 4150b1ee7c
commit 243b4d04e6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/c2/unexpected-talkers-macos.sql
View File

@ -176,6 +176,7 @@ WHERE
'443,6,0,Setup,com.adobe.acc.Setup,Developer ID Application: Adobe Inc. (JQ525L2MZD)', '443,6,0,Setup,com.adobe.acc.Setup,Developer ID Application: Adobe Inc. (JQ525L2MZD)',
'443,6,500,,,', '443,6,500,,,',
'443,6,500,steampipe-plugin-aws.plugin,a.out,', '443,6,500,steampipe-plugin-aws.plugin,a.out,',
'443,6,500,Kindle,com.amazon.Lassen,TestFlight Beta Distribution',
'443,6,500,Acrobat Update Helper,com.adobe.ARMDCHelper,Developer ID Application: Adobe Inc. (JQ525L2MZD)', '443,6,500,Acrobat Update Helper,com.adobe.ARMDCHelper,Developer ID Application: Adobe Inc. (JQ525L2MZD)',
'443,6,500,apko,a.out,', '443,6,500,apko,a.out,',
'443,6,500,aws,37c466-aws,Developer ID Application: AMZN Mobile LLC (94KV3E626L)', '443,6,500,aws,37c466-aws,Developer ID Application: AMZN Mobile LLC (94KV3E626L)',

4
detection/execution/recently-created-executables-macos.sql
View File

@ -93,6 +93,10 @@ WHERE
AND NOT path LIKE '/usr/local/Cellar/%' AND NOT path LIKE '/usr/local/Cellar/%'
AND NOT path LIKE '/usr/sbin/%' AND NOT path LIKE '/usr/sbin/%'
AND NOT path LIKE '%/.vscode/extensions/%' AND NOT path LIKE '%/.vscode/extensions/%'
AND NOT (
path LIKE '/private/var/folders/%/d/Wrapper/%.app/%'
AND s.authority = 'TestFlight Beta Distribution'
)
) )
AND f.ctime > 0 AND f.ctime > 0
AND (p0.start_time - MAX(f.ctime, f.btime)) < 180 AND (p0.start_time - MAX(f.ctime, f.btime)) < 180

1
detection/execution/unexpected-execdir-events-macos.sql
View File

@ -218,6 +218,7 @@ WHERE
AND dir NOT LIKE '/private/var/folders/%/Contents/%' AND dir NOT LIKE '/private/var/folders/%/Contents/%'
AND dir NOT LIKE '/private/var/folders/%/go-build%' AND dir NOT LIKE '/private/var/folders/%/go-build%'
AND dir NOT LIKE '/private/var/folders/%/GoLand' AND dir NOT LIKE '/private/var/folders/%/GoLand'
AND dir NOT LIKE '/private/var/folders/%/d/Wrapper/%.app'
AND dir NOT LIKE '~/%repo%' AND dir NOT LIKE '~/%repo%'
AND dir NOT LIKE '~/%sigstore%' AND dir NOT LIKE '~/%sigstore%'
AND dir NOT LIKE '%/.terraform/providers/%' AND dir NOT LIKE '%/.terraform/providers/%'