From cfed94d0d914e6d16a57a34896938b78e83b6019 Mon Sep 17 00:00:00 2001 From: Thomas Stromberg Date: Fri, 21 Oct 2022 18:15:41 -0400 Subject: [PATCH 1/2] Add exception for firefox-wrapper on port 80 --- detection/c2/unexpected-talkers-linux.sql | 1 + 1 file changed, 1 insertion(+) diff --git a/detection/c2/unexpected-talkers-linux.sql b/detection/c2/unexpected-talkers-linux.sql index 581afad..7b040e2 100644 --- a/detection/c2/unexpected-talkers-linux.sql +++ b/detection/c2/unexpected-talkers-linux.sql @@ -92,6 +92,7 @@ WHERE '8000,6,500,/opt/chrome,0u,0g,chrome', '8000,6,500,/usr/firefox,0u,0g,firefox', '80,6,0,/usr/NetworkManager,0u,0g,NetworkManager', + '80,6,500,/usr/firefox,0u,0g,.firefox-wrappe', '80,6,0,/usr/tailscaled,0u,0g,tailscaled', '80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra', '80,6,500,/app/thunderbird,u,g,thunderbird', From f0617d5ee2a167c14ff7e9842092be638de5f3a7 Mon Sep 17 00:00:00 2001 From: Thomas Stromberg Date: Mon, 24 Oct 2022 10:00:58 -0400 Subject: [PATCH 2/2] unexpected-osascript: Include signature data --- .../execution/unexpected-osascript-calls.sql | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/detection/execution/unexpected-osascript-calls.sql b/detection/execution/unexpected-osascript-calls.sql index b6be6f8..0f637d2 100644 --- a/detection/execution/unexpected-osascript-calls.sql +++ b/detection/execution/unexpected-osascript-calls.sql @@ -15,18 +15,25 @@ SELECT p.euid, p.parent, p.syscall, - hash.sha256, pp.path AS parent_path, pp.name AS parent_name, - TRIM(p.cmdline) AS parent_cmd, + TRIM(pp.cmdline) AS parent_cmd, pp.euid AS parent_euid, - phash.sha256 AS parent_sha256 + hash.sha256 AS parent_sha256, + signature.identifier AS parent_identifier, + signature.authority AS parent_auth, + CONCAT(signature.identifier, ",", signature.authority, ",", SUBSTR(TRIM(p.cmdline), 0, 54)) AS exception_key FROM uptime, process_events p LEFT JOIN processes pp ON p.parent = pp.pid - LEFT JOIN hash ON p.path = hash.path - LEFT JOIN hash AS phash ON pp.path = hash.path + LEFT JOIN hash ON pp.path = hash.path + LEFT JOIN signature ON pp.path = signature.path WHERE p.path = '/usr/bin/osascript' AND p.time > (strftime('%s', 'now') -60) + AND exception_key != 'com.vng.zalo,Developer ID Application: VNG ONLINE CO.,LTD (CVB6BX97VM),osascript -ss' + AND cmd != 'osascript -e user locale of (get system info)' + AND NOT ( + exception_key='org.python.python,,osascript' AND parent_cmd LIKE '% /opt/homebrew/bin/jupyter-notebook' + ) \ No newline at end of file