RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #357 from tstromberg/feb16-fpr 

fpr: Incus, Firefox, mbim, networkd, incus
This commit is contained in:
Thomas Strömberg 2024-02-23 16:27:35 -05:00 committed by GitHub
parent d1f6aede22 a266879668
commit 51ecee8d9b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/c2/unexpected-talkers-macos.sql
View File

@ -256,7 +256,7 @@ WHERE
'Developer ID Application: Microsoft Corporation (UBF8T346G9),com.microsoft.teams2.helper',
'Developer ID Application: Microsoft Corporation (UBF8T346G9),net.java.openjdk.java',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.firefox',
'Developer ID Application: ]Mozilla Corporation (43AQ936H96),org.mozilla.firefoxdeveloperedition',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.firefoxdeveloperedition',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.thunderbird',
'Developer ID Application: Opera Software AS (A2P9LX4JPN),com.operasoftware.Opera.helper',
'Developer ID Application: Parallels International GmbH (4C6364ACXT),com.parallels.naptd',

9
detection/persistence/unexpected-uid0-daemon-linux.sql
View File

@ -169,15 +169,18 @@ WHERE
'haproxy,/usr/sbin/haproxy,0,system.slice,haproxy.service,0755',
'iio-sensor-prox,/usr/lib/iio-sensor-proxy,0,system.slice,iio-sensor-proxy.service,0755',
'iio-sensor-prox,/usr/libexec/iio-sensor-proxy,0,system.slice,iio-sensor-proxy.service,0755',
'incusd,/opt/incus/bin/incusd,0,lxc.monitor.j1,,0755',
'incusd,/opt/incus/bin/incusd,0,lxc.monitor.j1c,,0755',
'incusd,/opt/incus/bin/incusd,0,system.slice,incus.service,0755',
'ir_agent,/opt/rapid7/ir_agent/components/insight_agent/__VERSION__/ir_agent,0,system.slice,ir_agent.service,',
'ir_agent,/opt/rapid7/ir_agent/components/insight_agent/__VERSION__/ir_agent,0,system.slice,ir_agent.service,0700',
'ir_agent,/opt/rapid7/ir_agent/ir_agent,0,system.slice,ir_agent.service,',
'ir_agent,/opt/rapid7/ir_agent/ir_agent,0,system.slice,ir_agent.service,0700',
'irqbalance,/usr/sbin/irqbalance,0,system.slice,irqbalance.service,0755',
'iwd,/usr/lib/iwd/iwd,0,system.slice,iwd.service,0755',
'launcher,/nix/store/__VERSION__/bin/launcher,0,system.slice,kolide-launcher.service,0555',
'launcher,/usr/local/kolide-k2/bin/launcher,0,system.slice,launcher.kolide-k2.service,0755',
'launcher,/usr/local/kolide-k2/bin/launcher-updates/__VERSION__/launcher,0,system.slice,launcher.kolide-k2.service,0755',
'launcher,/var/kolide-k2/k2device.kolide.com/updates/launcher/__VERSION__/launcher,0,system.slice,launcher.kolide-k2.service,0755',
'libvirtd,/usr/bin/libvirtd,0,system.slice,libvirtd.service,0755',
'lightdm,/nix/store/__VERSION__/bin/lightdm,0,system.slice,display-manager.service,0555',
'lightdm,/nix/store/__VERSION__/bin/lightdm,0,user.slice,user-1000.slice,0555',
@ -189,11 +192,13 @@ WHERE
'login,/usr/bin/login,0,user.slice,user-1000.slice,0755',
'low-memory-moni,/usr/libexec/low-memory-monitor,0,system.slice,low-memory-monitor.service,0755',
'lxcfs,/opt/incus/bin/lxcfs,0,system.slice,incus-lxcfs.service,0755',
'mbim-proxy,/usr/libexec/mbim-proxy,0,system.slice,ModemManager.service,0755',
'mcelog,/usr/sbin/mcelog,0,system.slice,mcelog.service,0755',
'multipathd,/usr/sbin/multipathd,0,system.slice,multipathd.service,0755',
'nessus-service,/opt/nessus/sbin/nessus-service,0,system.slice,nessusd.service,0755',
'nessusd,/opt/nessus/sbin/nessusd,0,system.slice,nessusd.service,0755',
'networkd-dispat,/usr/bin/python3.10,0,system.slice,networkd-dispatcher.service,0755',
'networkd-dispat,/usr/bin/python__VERSION__,0,system.slice,networkd-dispatcher.service,0755',
'nix-daemon,/nix/store/__VERSION__/bin/nix,0,system.slice,nix-daemon.service,0555',
'nm-dispatcher,/usr/lib/nm-dispatcher,0,system.slice,NetworkManager-dispatcher.service,0755',
'nm-openvpn-serv,/usr/libexec/nm-openvpn-service,0,system.slice,NetworkManager.service,0755',
@ -214,6 +219,7 @@ WHERE
'power-profiles-,/usr/lib/power-profiles-daemon,0,system.slice,power-profiles-daemon.service,0755',
'power-profiles-,/usr/libexec/power-profiles-daemon,0,system.slice,power-profiles-daemon.service,0755',
'pwrstatd,/usr/sbin/pwrstatd,0,system.slice,pwrstatd.service,0700',
'python3,/usr/bin/python__VERSION__,0,system.slice,ubuntu-advantage.service,0755',
'qualys-cloud-ag,/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent,0,system.slice,qualys-cloud-agent.service,0700',
'rapid7_endpoint,/opt/rapid7/ir_agent/components/endpoint_broker/__VERSION__/rapid7_endpoint_broker,0,system.slice,ir_agent.service,0744',
'rsyslogd,/usr/sbin/rsyslogd,0,system.slice,rsyslog.service,0755',
@ -271,6 +277,7 @@ WHERE
'upowerd,/usr/lib/upowerd,0,system.slice,upower.service,0755',
'upowerd,/usr/libexec/upowerd,0,system.slice,upower.service,0755',
'uresourced,/usr/libexec/uresourced,0,system.slice,uresourced.service,0755',
'v4l2-relayd,/usr/bin/v4l2-relayd,0,system.slice,v4l2-relayd.service,0755',
'velociraptor_cl,/usr/local/bin/velociraptor,0,system.slice,velociraptor_client.service,0700',
'virtiofsd,/opt/incus/bin/virtiofsd,0,system.slice,incus.service,0755',
'virtlogd,/usr/bin/virtlogd,0,system.slice,virtlogd.service,0755',