Add two Docker checks that can catch Traitor

detection/credentials/macos_keyboard_sniffer.sql

@@ -33,6 +33,7 @@ WHERE
   event_tapped IN ('EventKeyDown', 'EventKeyUp')
   AND authority != 'Software Signing'
   AND NOT exception_key IN (
+    'BetterTouchTool,com.hegenberg.BetterTouchTool,Developer ID Application: folivora.AI GmbH (DAFVSXZ82P)',
     'iTerm2,com.googlecode.iterm2,Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D)',
     'lghub_agent,com.logi.ghub.agent,Developer ID Application: Logitech Inc. (QED4VVPZWA)',
     'logioptionsplus_agent,com.logi.cp-dev-mgr,Developer ID Application: Logitech Inc. (QED4VVPZWA)',

detection/credentials/unexpected-sensitive-file-access-linux.sql

@@ -54,7 +54,8 @@ WHERE
   f.uid != ''
   AND pf.filename != ''
   AND (
-    pof.path LIKE '/home/%/.ssh/%'
+    pof.path IN ('/var/run/docker.sock')
+    OR pof.path LIKE '/home/%/.ssh/%'
     OR pof.path LIKE '/home/%/.mozilla/firefox/%'
     OR pof.path LIKE '/home/%/.config/google-chrome/%'
     OR pof.path LIKE '/root/.ssh/%'

detection/privesc/docker-container-mounting-root.sql

@@ -0,0 +1,18 @@
+-- Detect the execution of a Docker containing mounting the root filesystem
+--
+-- references:
+--   * https://attack.mitre.org/techniques/T1611/
+--   * https://github.com/liamg/traitor/blob/main/pkg/exploits/dockersock/exploit.go
+--
+-- This attack is very quick, so the likelihood of finding a culprit is entirely
+-- dependent on the polling time.
+--
+-- platform: linux
+-- tags: ephemeral often
+SELECT
+  command, image_id, path, security_options, started_at, image
+FROM
+  docker_containers
+WHERE
+  privileged = 1
+  AND image NOT LIKE 'kindest/node:%';

detection/privesc/sketchy-docker-image-creator.sql

@@ -0,0 +1,16 @@
+-- Detect the execution of a Docker containing mounting the root filesystem
+--
+-- references:
+--   * https://attack.mitre.org/techniques/T1611/
+--   * https://github.com/liamg/traitor/blob/main/pkg/exploits/dockersock/exploit.go
+--
+-- This attack is very quick, so the likelihood of finding a culprit is entirely
+-- dependent on the polling time. The number of "tags" you see associated to an image
+-- may reflect the number of times the attack has been attempted.
+--
+-- platform: linux
+-- tags: ephemeral often
+SELECT * FROM docker_image_history
+WHERE created > (strftime('%s', 'now') -86400)
+-- This signature is used by Traitor: https://github.com/liamg/traitor/
+AND created_by LIKE "%/bin/sh%/lol%";