RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add more examples of legit executables, namely ibus-* and *Manager

This commit is contained in:
Thomas Stromberg 2023-01-20 09:29:10 -05:00
parent e6824d87e9
commit 29d563f2df
Failed to extract signature
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
detection/execution/recently-created-executables-linux.sql
View File

@ -58,9 +58,11 @@ WHERE
'/usr/bin/docker', '/usr/bin/docker',
'/usr/bin/dockerd', '/usr/bin/dockerd',
'/usr/bin/docker-proxy', '/usr/bin/docker-proxy',
'/usr/bin/gedit',
'/usr/bin/gnome-keyring-daemon',
'/usr/bin/fusermount3', '/usr/bin/fusermount3',
'/usr/bin/gedit',
'/usr/bin/gjs-console',
'/usr/bin/gnome-keyring-daemon',
'/usr/bin/ibus-daemon',
'/usr/bin/kbfsfuse', '/usr/bin/kbfsfuse',
'/usr/bin/keybase', '/usr/bin/keybase',
'/usr/bin/keybase-redirector', '/usr/bin/keybase-redirector',
@ -70,6 +72,7 @@ WHERE
'/usr/bin/pavucontrol', '/usr/bin/pavucontrol',
'/usr/bin/pipewire', '/usr/bin/pipewire',
'/usr/bin/pipewire-pulse', '/usr/bin/pipewire-pulse',
'/usr/bin/python3.11',
'/usr/bin/rpi-imager', '/usr/bin/rpi-imager',
'/usr/bin/snap', '/usr/bin/snap',
'/usr/bin/tailscaled', '/usr/bin/tailscaled',
@ -85,10 +88,14 @@ WHERE
'/usr/libexec/bluetooth/bluetoothd', '/usr/libexec/bluetooth/bluetoothd',
'/usr/libexec/docker/docker-proxy', '/usr/libexec/docker/docker-proxy',
'/usr/libexec/fwupd/fwupd', '/usr/libexec/fwupd/fwupd',
'/usr/libexec/ibus-dconf',
'/usr/libexec/ibus-engine-simple',
'/usr/libexec/ibus-extension-gtk3',
'/usr/libexec/ibus-portal',
'/usr/libexec/ibus-x11',
'/usr/libexec/snapd/snapd', '/usr/libexec/snapd/snapd',
'/usr/libexec/sssd/sssd_kcm', '/usr/libexec/sssd/sssd_kcm',
'/usr/libexec/tracker-extract-3', '/usr/libexec/tracker-extract-3',
'/usr/lib/tracker-extract-3',
'/usr/libexec/tracker-miner-fs-3', '/usr/libexec/tracker-miner-fs-3',
'/usr/lib/flatpak-session-helper', '/usr/lib/flatpak-session-helper',
'/usr/lib/fwupd/fwupd', '/usr/lib/fwupd/fwupd',
@ -110,6 +117,7 @@ WHERE
'/usr/lib/systemd/systemd-timesyncd', '/usr/lib/systemd/systemd-timesyncd',
'/usr/lib/systemd/systemd-userdbd', '/usr/lib/systemd/systemd-userdbd',
'/usr/lib/systemd/systemd-userwork', '/usr/lib/systemd/systemd-userwork',
'/usr/lib/tracker-extract-3',
'/usr/lib/x86_64-linux-gnu/obs-plugins/obs-browser-page', '/usr/lib/x86_64-linux-gnu/obs-plugins/obs-browser-page',
'/usr/lib/xdg-desktop-portal-gtk', '/usr/lib/xdg-desktop-portal-gtk',
'/usr/lib/xf86-video-intel-backlight-helper', '/usr/lib/xf86-video-intel-backlight-helper',
@ -118,6 +126,8 @@ WHERE
'/usr/sbin/avahi-daemon', '/usr/sbin/avahi-daemon',
'/usr/sbin/chronyd', '/usr/sbin/chronyd',
'/usr/sbin/cupsd', '/usr/sbin/cupsd',
'/usr/sbin/ModemManager',
'/usr/sbin/NetworkManager',
'/usr/sbin/rngd', '/usr/sbin/rngd',
'/usr/sbin/tailscaled', '/usr/sbin/tailscaled',
'/usr/share/code/chrome_crashpad_handler', '/usr/share/code/chrome_crashpad_handler',