Address PR comments

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
2024-10-30 11:33:49 -05:00 · 2024-10-30 11:33:49 -05:00 · 4abd265459
parent 18e9879b01
commit 4abd265459
1 changed files with 2 additions and 0 deletions
--- a/detection/c2/unexpected-talkers-macos.sql
+++ b/detection/c2/unexpected-talkers-macos.sql
@ -112,5 +112,7 @@ WHERE pos.pid IN (
  AND NOT (
    unsigned_exception = '500,0,0,chainlink,chainlink'
    AND p0.path LIKE '/var/folders/%/T/go-build%/b001/exe/chainlink'
+    AND remote_port = 0
+    AND protocol = 0
  )
 GROUP BY p0.cmdline