fpr: syncthing

2024-01-09 16:19:52 -05:00 · 2024-01-09 16:19:52 -05:00 · 27a0d55737
parent 229a32a61e
commit 27a0d55737
1 changed files with 4 additions and 0 deletions
--- a/detection/c2/unexpected-talkers-macos.sql
+++ b/detection/c2/unexpected-talkers-macos.sql
@ -208,6 +208,10 @@ WHERE
    AND remote_port > 20
    AND remote_port < 32000
  )
+  AND NOT (
+    exception_key LIKE '500,6,%,syncthing,syncthing,Developer ID Application: Kastelo AB (LQE5SYM783),syncthing'
+    AND remote_port > 24
+  )
  AND NOT (
    exception_key LIKE '500,6,%,syncthing,syncthing,Developer ID Application: Jakob Borg (LQE5SYM783),syncthing'
    AND remote_port > 24