Merge pull request #52 from tstromberg/fp44

Add exceptions for Jetbrains/Delve, more for Steam

detection/credentials/unexpected-dev-opener-linux.sql

@@ -80,6 +80,7 @@ WHERE
     '/dev/nvidiactl',
     '/dev/ptmx',
     '/dev/pts/ptmx',
+    '/dev/shm/u1000-ValveIPCSharedObj-Steam',
     '/dev/random',
     '/dev/rfkill',
     '/dev/snd/seq',
@@ -97,6 +98,7 @@ WHERE
   AND NOT dir_exception IN (
     '/dev/bus/usb,pcscd',
     '/dev/input,acpid',
+    '/dev/shm,gameoverlayui',
     '/dev/input,gnome-shell',
     '/dev/input,systemd',
     '/dev/input,systemd-logind',

detection/evasion/unexpected-dev-executables-linux.sql

@@ -4,8 +4,7 @@
 --   * https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
 --
 -- tags: persistent state filesystem
-SELECT
+SELECT file.path,
-  file.path,
   file.directory,
   uid,
   gid,
@@ -14,12 +13,10 @@ SELECT
   file.size,
   hash.sha256,
   magic.data
-FROM
+FROM file
-  file
   LEFT JOIN hash on file.path = hash.path
   LEFT JOIN magic ON file.path = magic.path
-WHERE
+WHERE (
-  (
     -- This list is the result of multiple queries combined and can likely be minimized
     file.path LIKE '/dev/%%'
     OR file.path LIKE '/dev/%%/%%'
@@ -50,3 +47,11 @@ WHERE
     AND file.path LIKE '/dev/shm/pulse-shm-%'
     AND file.size > 60000000
   )
+  -- Seen with Steam
+  AND NOT (
+    file.uid = 1000
+    AND file.gid = 100
+    AND file.mode = 0755
+    AND file.path LIKE '/dev/shm/u1000-Shm_%'
+    AND file.size > 10000000
+  )

detection/evasion/unexpected-var-executables-macos.sql

@@ -85,3 +85,10 @@ WHERE
     AND file.size < 3000
     AND file.mode = 0755
   )
+  -- JetBrains (Delve)
+  AND NOT (
+    file.path LIKE '/var/folders/%/T/dlvLauncher.sh'
+    AND magic.data LIKE 'Bourne-Again shell script%'
+    AND file.size < 1024
+    AND file.mode = 0744
+  )

detection/execution/exotic-command-events-linux.sql

@@ -136,3 +136,4 @@ WHERE
   -- Seen on Ubuntu
   AND NOT cmd LIKE 'rm -f /tmp/apt-key-gpghome.%/pubring.gpg'
   AND NOT cmd LIKE 'rm -f /var/tmp/mkinitramfs_%'
+  AND NOT cmd LIKE 'rm -f -- /tmp/%'